OpenBSD vulnerabilities
51 CVEs and advisories name OpenBSD as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-123158sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass…
- CVE-2026-118374LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response
- CVE-2026-118373LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
- CVE-2026-118372LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
- CVE-2026-118371LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
- CVE-2026-106583In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
- CVE-2026-106589In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privile
- CVE-2026-106588In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpect
- CVE-2026-106587In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean
- CVE-2026-106586In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a
- CVE-2026-106585In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly c
- CVE-2026-106584In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling.
- CVE-2026-106582In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Cr
- CVE-2026-106555In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
- CVE-2026-106553In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.
- CVE-2026-106552In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recu
- CVE-2026-103547In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP ch
- CVE-2026-56101OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS
- CVE-2026-73283In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
- CVE-2026-73282In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
- CVE-2026-73281In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that a
- CVE-2026-60002ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange.
- CVE-2026-60001sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
- CVE-2026-60000sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempt
- CVE-2026-59999In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
- CVE-2026-59998sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windo
- CVE-2026-59997internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-l
- CVE-2026-59996scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destina
- CVE-2026-59995sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker
- CVE-2026-57589sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root.