diff --git a/CHANGELOG b/CHANGELOG
index 95190ce8..998fa7e0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -65,6 +65,9 @@ HISTORY
 
  ++ Bugfixes:
 
+  2011-09-27: Simon Goldschmidt
+  * tcp_in.c: fixed bug #28288: Data after FIN in oos queue
+
   2011-09-27: Simon Goldschmidt
   * dhcp.c: fixed bug #34406 dhcp_option_hostname() can overflow the pbuf
 
diff --git a/src/core/tcp_in.c b/src/core/tcp_in.c
index c659b494..704d310c 100644
--- a/src/core/tcp_in.c
+++ b/src/core/tcp_in.c
@@ -892,6 +892,8 @@ tcp_receive(struct tcp_pcb *pcb)
   u16_t new_tot_len;
   int found_dupack = 0;
 
+  LWIP_ASSERT("tcp_receive: wrong state", pcb->state >= ESTABLISHED);
+
   if (flags & TCP_ACK) {
     right_wnd_edge = pcb->snd_wnd + pcb->snd_wl2;
 
@@ -1132,8 +1134,10 @@ tcp_receive(struct tcp_pcb *pcb)
   }
 
   /* If the incoming segment contains data, we must process it
-     further. */
-  if (tcplen > 0) {
+     further unless the pcb already received a FIN.
+     (RFC 793, chapeter 3.9, "SEGMENT ARRIVES" in states CLOSE-WAIT, CLOSING,
+     LAST-ACK and TIME-WAIT: "Ignore the segment text.") */
+  if ((tcplen > 0) && (pcb->state < CLOSE_WAIT)) {
     /* This code basically does three things:
 
     +) If the incoming segment contains data that is the next