diff --git a/CHANGES b/CHANGES
index 6d23d8131dcdcb463ca38e2f0ebcd5b10e769fad..0f66f8d36d7644c58bab837de35210d833462efa 100644
--- a/CHANGES
+++ b/CHANGES
@@ -627,6 +627,12 @@
 
  Changes between 1.0.1j and 1.0.1k [xx XXX xxxx]
 
+   *) Do not resume sessions on the server if the negotiated protocol
+      version does not match the session's version. Resuming with a different
+      version, while not strictly forbidden by the RFC, is of questionable
+      sanity and breaks all known clients.
+      [David Benjamin, Emilia Käsper]
+
    *) Tighten handling of the ChangeCipherSpec (CCS) message: reject
       early CCS messages during renegotiation. (Note that because
       renegotiation is encrypted, this early CCS was not exploitable.)
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index f79957f1d7f6e67b572e17de21fefcf7d6af8957..f95f9c77e8c8be364ff925428a034e175598db17 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -1054,7 +1054,16 @@ int ssl3_get_client_hello(SSL *s)
 	else
 		{
 		i=ssl_get_prev_session(s, p, j, d + n);
-		if (i == 1)
+		/*
+		 * Only resume if the session's version matches the negotiated
+		 * version.
+		 * RFC 5246 does not provide much useful advice on resumption
+		 * with a different protocol version. It doesn't forbid it but
+		 * the sanity of such behaviour would be questionable.
+		 * In practice, clients do not accept a version mismatch and
+		 * will abort the handshake with an error.
+		 */
+		if (i == 1 && s->version == s->session->ssl_version)
 			{ /* previous session */
 			s->hit=1;
 			}