On October 23, 2026, OpenSSL released version 4.1.0, which adds DTLS 1.3 (RFC 9147) support alongside four known bugs in that same code, two of which make a connection’s return codes lie to the application. If you adopt DTLS 1.3 server-side, do not take SSL_ERROR_WANT_READ or SSL_ERROR_SYSCALL at face value.
On 29 September 2026, OpenSSL fixed CVE-2026-84782, an out-of-bounds read in DTLS retransmission that can expose heap memory as plaintext or crash the program. Upgrade to 4.0.3, 3.6.5, 3.5.9 or 3.4.8, then audit every binary that bundles its own OpenSSL.
On September 15, 2026, nginx shipped 1.31.6 and 1.30.5 to close CVE-2026-90439, a heap buffer overflow in its HTTP/3 module that hits builds linked against OpenSSL 3.5.0 or earlier. Upgrade both nginx and OpenSSL, then disable HTTP/3 on edges that do not need it.
On September 9, 2026, the first OpenSSL 4.1 alpha enabled DTLS 1.3 — shorter handshakes, forward secrecy and built-in post-quantum crypto — plus GREASE, the mechanism that stops middleboxes from ossifying TLS. For anyone running gateways, IoT fleets or UDP-based services, it is the signal to start planning the migration.
