For stateful sessions a memory leak has been found, and fixed, for 4.0.2
We will release 4.0.3 early next week that address this issue. Stateless
sessions are not affected, but if you are using stateful with lots
sessions on the same rulebase then its recommended you stay with 4.0.1
until we release 4.0.3 next week.