Commit 7501955b0b for openssl.org

commit 7501955b0b2fbd6e7348bc8166055993d73af64e
Author: Ryan Hooper <ryanh@openssl.foundation>
Date:   Wed Oct 21 13:27:28 2026 -0400

    Document DTLS 1.3 handshake ACK known issue

    Note that servers may reject ACKs received while waiting for the
    client's handshake response.

    Refs: #33242
    Refs: #33267
    Assisted-by: OpenAI:gpt-6-astra
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Merge-date: Thu Oct 22 14:58:41 2026
    Merged-from: https://github.com/openssl/openssl/pull/33296

diff --git a/NEWS.md b/NEWS.md
index e192ea35b7..2039e1b19c 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -99,6 +99,12 @@ Known issues in 4.1.0
     `SSL_ERROR_WANT_WRITE`. Applications treating this result as fatal may
     close a connection that is still usable.

+  * <https://github.com/openssl/openssl/issues/33242>
+    DTLS 1.3 servers may abort handshakes with an `unexpected_message` alert
+    when a client acknowledges part or all of the server's first flight
+    before sending its response. This can occur after packet loss or while
+    the client is preparing its authentication response.
+
 OpenSSL 4.0
 -----------