Teams adopting OpenSSL 4.1.0 receive DTLS 1.3 support alongside four known defects in that code. Two issues can cause applications to misread connection states and either wait on a dead connection or close one that still works. Another can abort a handshake after packet loss, while a KeyUpdate issue can prevent retransmission of an outstanding session ticket. One fix is in progress, with no fix status listed for the other three.
Why It Matters
The risk falls mainly on developers and operators adopting the new DTLS features. For leaders: a new security capability can still introduce reliability and compatibility costs. For defenders: test failure handling, packet-loss behavior and post-handshake operations before production deployment. Applications should not take the affected error codes at face value until fixes arrive. The larger lesson is that secure protocol adoption needs operational testing, not just library upgrades.
What Defenders Should Do
Test OpenSSL 4.1.0 DTLS paths under failure conditions and delay sensitive deployments if the known defects are unacceptable.