Skip to content
NewA calmer, faster ZeroHour
StoryToolsmedium

OpenSSL 4.1.0 ships DTLS 1.3 with four known bugs

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

OpenSSL 4.1.0, released October 23 as a feature update, adds DTLS 1.3 while four documented DTLS bugs remain.

OpenSSL published version 4.1.0 on October 23 as a feature release, not a standalone security patch. It adds DTLS 1.3, defined in RFC 9147, including a new SSL listener DTLS path, plus GREASE, the IKEv2 key derivation function, and initial Elbrus2000 support. Four known DTLS bugs remain: a permanent receive failure can appear as SSL_ERROR_WANT_READ; a retryable write failure on a nonblocking accepted connection can appear as SSL_ERROR_SYSCALL; a server may abort a handshake with unexpected_message after packet loss; and KeyUpdate can drop outstanding post-handshake records so a lost NewSessionTicket is not resent. Help Net Security says a fix is in progress only for the ticket bug and that OpenSSL lists no fix status for the other three; Cyber Security News says the four issues still await a fix planned for a later release. no-ecdsa and no-ecdh were removed in favor of no-ec, and Windows-on-Itanium and Windows CE targets were dropped.

Key facts
  • DTLS 1.3 follows RFC 9147 and uses the SSL listener path.
  • KeyUpdate can drop a lost NewSessionTicket instead of resending it.
  • no-ecdsa and no-ecdh were removed; users should use no-ec.
  • tsget now requires Perl module Net::Curl::Easy, not WWW::Curl::Easy.
  • ML-KEM and ML-DSA are faster on ppc64le and x86_64; no benchmarks given.
  • Windows-on-Itanium and Windows CE build targets were dropped.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 23, 2026OpenSSL published 4.1.0 as a feature release · Cyber Security News

What each outlet adds

beyond the shared facts
  • Help Net SecurityNames the four DTLS failure modes and says only the ticket bug has a fix in progress.
  • Cyber Security NewsDates the October 23 release and adds GREASE, IKEv2 KDF, and Elbrus2000.
Vendors
OpenSSL
Organizations
OpenSSL project

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Help Net SecurityFirst report

    OpenSSL 4.1.0 adds DTLS 1.3 and ships four known DTLS bugs

    Two bugs can misreport connection state, one can abort handshakes after packet loss, and KeyUpdate can drop a lost NewSessionTicket.

  2. · 4d ago Cyber Security News

    OpenSSL 4.1.0 adds DTLS 1.3 and post-quantum speedups

    The October 23 feature release is not a security patch and documents four DTLS issues still awaiting a fix.