diff --git a/configs/components/openssl-3.0.rb b/configs/components/openssl-3.0.rb
index 9b0a2efdd..b60154ff8 100644
--- a/configs/components/openssl-3.0.rb
+++ b/configs/components/openssl-3.0.rb
@@ -1,6 +1,6 @@
 component 'openssl' do |pkg, settings, platform|
-  pkg.version '3.0.13'
-  pkg.sha256sum '88525753f79d3bec27d2fa7c66aa0b92b3aa9498dafd93d7cfa4b3780cdae313'
+  pkg.version '3.0.14'
+  pkg.sha256sum 'eeca035d4dd4e84fc25846d952da6297484afa0650a6f84c682e39df3a4123ca'
   pkg.url "https://openssl.org/source/openssl-#{pkg.get_version}.tar.gz"
   pkg.mirror "#{settings[:buildsources_url]}/openssl-#{pkg.get_version}.tar.gz"
 
@@ -27,9 +27,6 @@
     pkg.environment 'CYGWIN', settings[:cygwin]
     pkg.environment 'MAKE', platform[:make]
 
-    # Remove this in 3.0.14 or later
-    pkg.apply_patch 'resources/patches/openssl/openssl-3.0.13-crypto-providers.patch'
-
     target = platform.architecture == 'x64' ? 'mingw64' : 'mingw'
   elsif platform.is_aix?
     raise "openssl-3.0 is not supported on older AIX" if platform.name == 'aix-7.1-ppc'
@@ -85,9 +82,6 @@
     end
   end
 
-  # Remove this in 3.0.14 or later
-  pkg.apply_patch 'resources/patches/openssl/CVE-2024-2511.patch'
-
   ####################
   # BUILD REQUIREMENTS
   ####################
diff --git a/resources/patches/openssl/CVE-2024-2511.patch b/resources/patches/openssl/CVE-2024-2511.patch
deleted file mode 100644
index bd26f54a8..000000000
--- a/resources/patches/openssl/CVE-2024-2511.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
-index 81a9f0728d..92bfaa3b02 100644
---- a/ssl/ssl_lib.c
-+++ b/ssl/ssl_lib.c
-@@ -3717,9 +3717,10 @@ void ssl_update_cache(SSL *s, int mode)
- 
-     /*
-      * If the session_id_length is 0, we are not supposed to cache it, and it
--     * would be rather hard to do anyway :-)
-+     * would be rather hard to do anyway :-). Also if the session has already
-+     * been marked as not_resumable we should not cache it for later reuse.
-      */
--    if (s->session->session_id_length == 0)
-+    if (s->session->session_id_length == 0 || s->session->not_resumable)
-         return;
- 
-     /*
-diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
-index d836b33ed0..75adbd9e52 100644
---- a/ssl/ssl_sess.c
-+++ b/ssl/ssl_sess.c
-@@ -152,16 +152,11 @@ SSL_SESSION *SSL_SESSION_new(void)
-     return ss;
- }
- 
--SSL_SESSION *SSL_SESSION_dup(const SSL_SESSION *src)
--{
--    return ssl_session_dup(src, 1);
--}
--
- /*
-  * Create a new SSL_SESSION and duplicate the contents of |src| into it. If
-  * ticket == 0 then no ticket information is duplicated, otherwise it is.
-  */
--SSL_SESSION *ssl_session_dup(const SSL_SESSION *src, int ticket)
-+static SSL_SESSION *ssl_session_dup_intern(const SSL_SESSION *src, int ticket)
- {
-     SSL_SESSION *dest;
- 
-@@ -285,6 +280,27 @@ SSL_SESSION *ssl_session_dup(const SSL_SESSION *src, int ticket)
-     return NULL;
- }
- 
-+SSL_SESSION *SSL_SESSION_dup(const SSL_SESSION *src)
-+{
-+    return ssl_session_dup_intern(src, 1);
-+}
-+
-+/*
-+ * Used internally when duplicating a session which might be already shared.
-+ * We will have resumed the original session. Subsequently we might have marked
-+ * it as non-resumable (e.g. in another thread) - but this copy should be ok to
-+ * resume from.
-+ */
-+SSL_SESSION *ssl_session_dup(const SSL_SESSION *src, int ticket)
-+{
-+    SSL_SESSION *sess = ssl_session_dup_intern(src, ticket);
-+
-+    if (sess != NULL)
-+        sess->not_resumable = 0;
-+
-+    return sess;
-+}
-+
- const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s, unsigned int *len)
- {
-     if (len)
-diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c
-index a9e67f9d32..6c942e6bce 100644
---- a/ssl/statem/statem_srvr.c
-+++ b/ssl/statem/statem_srvr.c
-@@ -2338,9 +2338,8 @@ int tls_construct_server_hello(SSL *s, WPACKET *pkt)
-      * so the following won't overwrite an ID that we're supposed
-      * to send back.
-      */
--    if (s->session->not_resumable ||
--        (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)
--         && !s->hit))
-+    if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)
-+            && !s->hit)
-         s->session->session_id_length = 0;
- 
-     if (usetls13) {
diff --git a/resources/patches/openssl/openssl-3.0.13-crypto-providers.patch b/resources/patches/openssl/openssl-3.0.13-crypto-providers.patch
deleted file mode 100644
index 01b050f06..000000000
--- a/resources/patches/openssl/openssl-3.0.13-crypto-providers.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 7b3eda56d7891aceef91867de64f24b20e3db212 Mon Sep 17 00:00:00 2001
-From: Richard Levitte <levitte@openssl.org>
-Date: Thu, 1 Feb 2024 10:57:51 +0100
-Subject: [PATCH] Fix a few incorrect paths in some build.info files
-
-The following files referred to ../liblegacy.a when they should have
-referred to ../../liblegacy.a.  This cause the creation of a mysterious
-directory 'crypto/providers', and because of an increased strictness
-with regards to where directories are created, configuration failure
-on some platforms.
-
-Fixes #23436
-
-Reviewed-by: Matt Caswell <matt@openssl.org>
-Reviewed-by: Tomas Mraz <tomas@openssl.org>
-Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
-(Merged from https://github.com/openssl/openssl/pull/23452)
-
-(cherry picked from commit 667b45454a47959ce2934b74c899662e686993de)
----
- crypto/aes/build.info | 2 +-
- crypto/ec/build.info  | 2 +-
- crypto/sha/build.info | 2 +-
- 3 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/crypto/aes/build.info b/crypto/aes/build.info
-index b250903fa6e26..271015e35e1bb 100644
---- a/crypto/aes/build.info
-+++ b/crypto/aes/build.info
-@@ -76,7 +76,7 @@ DEFINE[../../providers/libdefault.a]=$AESDEF
- # already gets everything that the static libcrypto.a has, and doesn't need it
- # added again.
- IF[{- !$disabled{module} && !$disabled{shared} -}]
--  DEFINE[../providers/liblegacy.a]=$AESDEF
-+  DEFINE[../../providers/liblegacy.a]=$AESDEF
- ENDIF
- 
- GENERATE[aes-ia64.s]=asm/aes-ia64.S
-diff --git a/crypto/ec/build.info b/crypto/ec/build.info
-index a511e887a9ba1..6dd98e9f4f172 100644
---- a/crypto/ec/build.info
-+++ b/crypto/ec/build.info
-@@ -77,7 +77,7 @@ DEFINE[../../providers/libdefault.a]=$ECDEF
- # Otherwise, it already gets everything that the static libcrypto.a
- # has, and doesn't need it added again.
- IF[{- !$disabled{module} && !$disabled{shared} -}]
--  DEFINE[../providers/liblegacy.a]=$ECDEF
-+  DEFINE[../../providers/liblegacy.a]=$ECDEF
- ENDIF
- 
- GENERATE[ecp_nistz256-x86.S]=asm/ecp_nistz256-x86.pl
-diff --git a/crypto/sha/build.info b/crypto/sha/build.info
-index d61f7de9b6bde..186ec13cc82a1 100644
---- a/crypto/sha/build.info
-+++ b/crypto/sha/build.info
-@@ -88,7 +88,7 @@ DEFINE[../../providers/libdefault.a]=$SHA1DEF $KECCAK1600DEF
- # linked with libcrypto.  Otherwise, it already gets everything that
- # the static libcrypto.a has, and doesn't need it added again.
- IF[{- !$disabled{module} && !$disabled{shared} -}]
--  DEFINE[../providers/liblegacy.a]=$SHA1DEF $KECCAK1600DEF
-+  DEFINE[../../providers/liblegacy.a]=$SHA1DEF $KECCAK1600DEF
- ENDIF
- 
- GENERATE[sha1-586.S]=asm/sha1-586.pl