diff --git a/RHEL-192631-fix-ossl-ssl-new-ordering.patch b/RHEL-192631-fix-ossl-ssl-new-ordering.patch
new file mode 100644
index 0000000..e9c90d8
--- /dev/null
+++ b/RHEL-192631-fix-ossl-ssl-new-ordering.patch
@@ -0,0 +1,58 @@
+From 9bf89ca142bc89d5bf29fc9a437187dd0bffaaa9 Mon Sep 17 00:00:00 2001
+From: Cropi <alakatos@redhat.com>
+Date: Wed, 24 Jun 2026 13:07:05 +0200
+Subject: [PATCH] tcp: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client
+ connect path
+
+relpTcpConnectTLSInit_ossl() called SSL_new(ctx) before
+relpTcpSetSslConfCmd_ossl(), so SSL_CONF_cmd("Groups", ...) applied via
+tls.tlscfgcmd was updating the SSL_CTX after the SSL object had already
+captured its group list.  On OpenSSL 3.x this caused the client to
+advertise the full default group set (including X25519MLKEM768 on 3.5+)
+regardless of any Groups restriction in tlsConfigCmd.
+
+Move pThis->sslState = osslClient and relpTcpSetSslConfCmd_ossl() to
+before SSL_new() so the SSL object inherits the correctly configured
+SSL_CTX.  relpTcpTLSSetPrio() stays after SSL_new() because it operates
+on pThis->ssl via SSL_set_cipher_list().
+
+Adapted from upstream commit 9bf89ca for librelp-1.10.0 line numbers
+(post-downstream-patch context differs from 1.12.0).
+
+Signed-off-by: Cropi <alakatos@redhat.com>
+--- a/src/tcp.c
++++ b/src/tcp.c
+@@ -1790,6 +1790,15 @@
+ 	/*if we reach this point we are in tls mode */
+ 	pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: TLS Mode\n");
+ 
++	/* set before relpTcpSetSslConfCmd_ossl: tlsConfigCmd may contain
++	 * flag-restricted commands that require SSL_CONF_FLAG_CLIENT */
++	pThis->sslState = osslClient;
++
++	/* SSL_CONF_cmd targets the SSL_CTX; SSL_new() snapshots the SSL_CTX's
++	 * group list at construction time, so this must run before SSL_new()
++	 * or the SSL object keeps the default groups set by SSL_CTX_new() */
++	CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd));
++
+ 	if(!(pThis->ssl = SSL_new(ctx))) {
+ 		relpTcpLastSSLErrorMsg(0, pThis, "relpTcpConnectTLSInit");
+ 		ABORT_FINALIZE(RELP_RET_IO_ERR);
+@@ -1805,17 +1814,11 @@
+ 	} else
+ 		pThis->authmode = eRelpAuthMode_None;
+ 
+-	/* Set TLS Options if configured */
+-	CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd));
+-
+ 	/* Set TLS Priority Options */
+ 	CHKRet(relpTcpTLSSetPrio(pThis));
+ 
+ 	SSL_set_ex_data(pThis->ssl, 0, (void*)pThis);
+ 
+-	/*set client state */
+-	pThis->sslState = osslClient;
+-
+ 	/* Create BIO from ptcp socket! */
+ 	conn = BIO_new_socket(pThis->sock, BIO_NOCLOSE);
+ 	pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: Init conn BIO[%p] done\n", (void *)conn);
diff --git a/librelp.spec b/librelp.spec
index 7ec270a..32a13a3 100644
--- a/librelp.spec
+++ b/librelp.spec
@@ -1,7 +1,7 @@
 Summary: The Reliable Event Logging Protocol library
 Name: librelp
 Version: 1.10.0
-Release: 6%{?dist}
+Release: 7%{?dist}
 License: GPLv3+
 URL: http://www.rsyslog.com/
 Source0: http://download.rsyslog.com/%{name}/%{name}-%{version}.tar.gz
@@ -11,6 +11,10 @@ Patch0: librelp-1.10.0-rhbz1972067-relpEngineSetTLSLibByName.patch
 Patch1: librelp-1.10.0-crypto-compliance.patch
 Patch2: fix-openssl-fd-double-close.patch
 
+# https://github.com/rsyslog/librelp/commit/9bf89ca142bc89d5bf29fc9a437187dd0bffaaa9
+# Resolves: RHEL-192631
+Patch3: RHEL-192631-fix-ossl-ssl-new-ordering.patch
+
 %description
 Librelp is an easy to use library for the RELP protocol. RELP (stands
 for Reliable Event Logging Protocol) is a general-purpose, extensible
@@ -34,9 +38,10 @@ to develop applications using librelp.
 
 %prep
 %setup -q
-%patch0 -p1 -b .tls-by-name
-%patch1 -p1 -b .crypto-compliance
-%patch2 -p1
+%patch -P 0 -p1 -b .tls-by-name
+%patch -P 1 -p1 -b .crypto-compliance
+%patch -P 2 -p1
+%patch -P 3 -p1
 
 %build
 autoreconf -ivf
@@ -61,7 +66,11 @@ rm $RPM_BUILD_ROOT/%{_libdir}/*.la
 %{_libdir}/pkgconfig/relp.pc
 
 %changelog
-* Wed Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.10.0-6
+* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.10.0-7
+- Backport: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client connect path
+  Resolves: RHEL-192631
+
+* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.10.0-6
 - Backport: fix OpenSSL fd double-close in TLS teardown
   Resolves: RHEL-192630