Security2 hOctober 26, 2026, 06:33

OpenSSL 4.1.0 adds DTLS 1.3 with four known bugs

OpenSSL 4.1.0 ships DTLS 1.3 support per RFC 9147 but lists four known bugs in the DTLS code, two of which can make applications misread connection state. The release also removes the no-ecdsa and no-ecdh Configure options and makes tsget require the Net::Curl::Easy Perl module.

Help Net Security

Open source

Two DTLS 1.3 bugs surface as SSL_ERROR_WANT_READ and SSL_ERROR_SYSCALL
no-ecdsa and no-ecdh options removed as they did not disable code
tsget now requires Net::Curl::Easy instead of WWW::Curl::Easy
ML-KEM and ML-DSA get optimized NTT on ppc64le, ML-DSA on x86_64

#OpenSSL

OpenSSL 4.1 Released with DTLS 1.3, IKEv2 KDF and GREASE Support

Security

OpenSSL patches high-severity DTLS flaw leaking heap memory

Security

AI turned long-known PHP bugs into a mass exploitation crisis

Software

OpenSSL 4.1.0 adds DTLS 1.3 with four known bugs

OpenSSL 4.1 Released with DTLS 1.3, IKEv2 KDF and GREASE Support

OpenSSL patches high-severity DTLS flaw leaking heap memory

AI turned long-known PHP bugs into a mass exploitation crisis

Microsoft details three known bugs in Windows 11 26H2