OpenSSL 4.1.0 released with DTLS 1.3: what changes, known issues and who should upgrade

The OpenSSL Project has published OpenSSL 4.1.0 on GitHub, a feature release whose headline addition is DTLS 1.3 (RFC 9147). It also adds GREASE support, DTLS in the listener API and faster post-quantum and AES code paths, and it removes a few old build targets and options. The final version followed a delay: on 9 October the project shipped a second beta rather than 4.1.0 because of two newly reported potential security issues in the new DTLS 1.3 code.

Key points

• OpenSSL 4.1.0 is a feature release (not a long-term-support one) and appeared on the project's GitHub releases page on 23 October 2026.
• It adds DTLS 1.3 per RFC 9147, RFC 8701 GREASE, DTLS support in the SSL listener API, an IKEv2 KDF and initial Elbrus2000 (e2k) support.
• It drops the Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets and the no-ecdsa and no-ecdh Configure options; use no-ec instead.
• The release notes list four known DTLS 1.3 issues (#32878, #33277, #33278 and #33242); the project says a fix for #32878 is planned for a future release.
• The next long-term-support release is OpenSSL 4.2 in April 2027, and 5.0 follows in October 2027.

What to do

If you run a TLS-only server or client, nothing is urgent: 4.1.0 is a feature release, and OpenSSL 3.5 (LTS) remains supported until 8 April 2030. Test it, but you don't need to deploy it.

If you use OpenSSL 3.0, it reached end of life on 7 September 2026 and no longer receives public security fixes, according to the project. Move to 3.5 LTS, or to 4.0, which the project says is supported until 14 May 2027. If you depend on the FIPS provider in 3.0, the project notes that the remaining FIPS 140-2 certificates move to the CMVP Historical List on 21 September 2026.

If you want to try DTLS 1.3, read the ossl-guide-dtlsv13(7) manual page, run the two demos the project points to (demos/dtlsecho and demos/dtlslistenerecho), and check the known issues below first. If you maintain DTLS 1.2 software, note that SSL_new_listener() now supports DTLS but DTLSv1_listen() does not support DTLS 1.3.

If you use tsget, install Net::Curl::Easy from the Net-Curl CPAN distribution before upgrading; the tool no longer uses WWW::Curl::Easy.

If you build with no-ecdsa or no-ecdh, change your configuration to no-ec; those options never really disabled the implementations, and are gone.

What happened

The project's release notes describe 4.1.0 as "a feature release adding significant new functionality". The largest piece is DTLS 1.3. DTLS is the datagram version of TLS, used where connections run over UDP: VoIP and video, some IoT and device-management protocols, and VPNs. The project's post, quoting the DTLS standard, says DTLS 1.3 reduces handshake round trips compared with 1.2 and removes support for outdated cryptographic algorithms; it can also use the post-quantum algorithms OpenSSL added in 3.5. The work was credited to Frederik Wedel-Heinen and Ryan Hooper.

The full list of changes in the release notes:

• New features: DTLS 1.3 (RFC 9147), GREASE (RFC 8701, which randomly injects reserved values into protocol negotiations so implementations don't break when new values appear), DTLS in the SSL listener API, IKEv2 KDF, and initial support for the Elbrus2000 (e2k) architecture.
• Performance: optimised ML-DSA and ML-KEM number-theoretic-transform operations on ppc64le; optimised ML-DSA on x86_64; AVX-512-optimised SHAKE x4 for ML-DSA; and AVX-512 and VAES optimisations for AES-CBC decryption on x86_64.
• Build targets: new VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 targets that supply internal functions to bridge C99 gaps in MSVC 2013.
• Removals: VC-WIN64I, VC-CE, no-ecdsa and no-ecdh.
• Changed: tsget now uses Net::Curl::Easy.

The project's GitHub release page lists no CVEs or security fixes in 4.1.0.

Background

OpenSSL 4.0, the first major release since 2018, removed deprecated features including SSLv3, according to the project's release-schedule post. In May 2026 the project said it will now make a major release every two years: 4.2 in April 2027 as the next long-term-support release, then 5.0 in October 2027. Under that plan the final 4.x release is supported through the whole 5.x cycle.

The 4.1 cycle ran as follows:

Date (2026)	Event
9 September	4.1 alpha 1; the project writes that 4.1 "will be released in October 2026"
16 September	OpenSSL 3.0 end-of-life announcement
23 September	4.1 beta 1
9 October	4.1 beta 2, issued instead of the final release
23 October	4.1.0 on GitHub

Why the release slipped

On 9 October the project announced beta 2 rather than 4.1.0. Its message on the openssl-users list says two potential security issues in the DTLS 1.3 code, tracked as #33172 and #33173, were reported that day, and "we did not want to release 4.1.0 with known security issues in the new implementation". The final release notes list known DTLS 1.3 issues #32878, #33277, #33278 and #33242, but we could not confirm from the pages we could open what became of #33172 and #33173 or whether they were security-relevant; neither appears in the final known-issues list. Readers evaluating DTLS 1.3 should check those issue numbers on GitHub.

The known issues

According to the 4.1.0 release notes:

• #32878: after a DTLS 1.3 KeyUpdate, other outstanding post-handshake records, such as a NewSessionTicket, may no longer be retransmitted if lost. A fix is planned for a future release.
• #33277: a permanent receive failure on a DTLS listener may be reported as SSL_ERROR_WANT_READ, so applications could keep waiting.
• #33278: a retryable write failure may be reported as SSL_ERROR_SYSCALL, which applications may treat as fatal.
• #33242: a DTLS 1.3 server may abort a handshake with an unexpected_message alert when the client responds early to the server's first flight.

These are reliability problems rather than disclosed vulnerabilities, but anyone building a product on a first-generation implementation should test lossy-network behaviour before shipping.

What it means

For most deployments, 4.1 matters less than the support calendar around it. OpenSSL 3.0's end of life on 7 September 2026 pushes remaining users to 3.5 LTS or 4.x, and 4.2 in April 2027 will be the release to target if you want a long-support branch with DTLS 1.3 and the other 4.1 features. Linux distributions typically stay on the LTS line, so DTLS 1.3 will reach most users through distribution packages only later.

The performance work is aimed at post-quantum workloads. ML-KEM and ML-DSA, the standardised post-quantum key-exchange and signature schemes, depend on number-theoretic transforms, so faster implementations on x86_64 and ppc64le lower the cost of turning them on. The release notes don't give benchmark figures, so we don't either.

The removal of no-ecdsa and no-ecdh is the change most likely to break a build script. The project explains the options didn't really disable the implementations, so builds that relied on them for compliance or size reasons should move to no-ec, then verify what is actually compiled in.

What we don't know yet

• The status of #33172 and #33173, the two potential DTLS 1.3 security issues from 9 October.
• Which downstream projects and distributions will pick up 4.1.0, and when.
• Performance gains: the notes list optimisations but publish no numbers.
• Whether the final release date on GitHub corresponds to a separate announcement on openssl-library.org; the project's news page had no 4.1.0 release post when we checked.

What to watch next

Watch the OpenSSL GitHub issues for the DTLS 1.3 problems, the project's security advisories page, and the 4.1.x point releases. For background on certificates and trust in the TLS ecosystem, see how TLS certificate trust and revocation work.

Sources

• OpenSSL 4.1.0 release, GitHub
• OpenSSL 4.1 beta release announcement
• OpenSSL 4.1 beta 2 announcement, openssl-users list
• The OpenSSL Library supports DTLS 1.3
• OpenSSL 3.0 End of Life
• Future release schedule