# cve.now: OpenBSD

The newest entries naming OpenBSD as an affected vendor (up to 200), of 51 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123158](https://cve.now/CVE-2026-123158.md): sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass… (CVSS 8.1, KEV)
- [CVE-2026-118374](https://cve.now/CVE-2026-118374.md): LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response (CVSS 8.2)
- [CVE-2026-118373](https://cve.now/CVE-2026-118373.md): LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host() (CVSS 6.3)
- [CVE-2026-118372](https://cve.now/CVE-2026-118372.md): LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path (CVSS 6.3)
- [CVE-2026-118371](https://cve.now/CVE-2026-118371.md): LibreSSL through 4.4.0 CRLF Injection via OCSP\_sendreq\_new() Request Line (CVSS 6.3)
- [CVE-2026-106583](https://cve.now/CVE-2026-106583.md): In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection. (CVSS 2.5)
- [CVE-2026-106589](https://cve.now/CVE-2026-106589.md): In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privile (CVSS 2.9)
- [CVE-2026-106588](https://cve.now/CVE-2026-106588.md): In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpect (CVSS 3.1)
- [CVE-2026-106587](https://cve.now/CVE-2026-106587.md): In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean (CVSS 3.6)
- [CVE-2026-106586](https://cve.now/CVE-2026-106586.md): In sshd in OpenSSH before 10.6, the restrict keyword (in authorized\_keys) was supposed to be applicable to tunnel forwarding but was not, a (CVSS 2.5)
- [CVE-2026-106585](https://cve.now/CVE-2026-106585.md): In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly c (CVSS 6.5)
- [CVE-2026-106584](https://cve.now/CVE-2026-106584.md): In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. (CVSS 2.5)
- [CVE-2026-106582](https://cve.now/CVE-2026-106582.md): In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Cr (CVSS 3.7)
- [CVE-2026-106555](https://cve.now/CVE-2026-106555.md): In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. (CVSS 2.2)
- [CVE-2026-106553](https://cve.now/CVE-2026-106553.md): In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. (CVSS 2.2)
- [CVE-2026-106552](https://cve.now/CVE-2026-106552.md): In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recu (CVSS 4.2)
- [CVE-2026-103547](https://cve.now/CVE-2026-103547.md): In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP ch (CVSS 9.2)
- [CVE-2026-56101](https://cve.now/CVE-2026-56101.md): OpenBSD ieee80211\_crypto\_tkip.c TKIP MIC Countermeasure Logic Inversion DoS (CVSS 6.0)
- [CVE-2026-73283](https://cve.now/CVE-2026-73283.md): In sshd in OpenSSH before 10.5, the restrict keyword (in authorized\_keys) was supposed to be applicable to tunnel forwarding but was not. (CVSS 2.5)
- [CVE-2026-73282](https://cve.now/CVE-2026-73282.md): In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent. (CVSS 4.8)
- [CVE-2026-73281](https://cve.now/CVE-2026-73281.md): In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that a (CVSS 3.5)
- [CVE-2026-60002](https://cve.now/CVE-2026-60002.md): ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (CVSS 7.7)
- [CVE-2026-60001](https://cve.now/CVE-2026-60001.md): sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. (CVSS 6.5)
- [CVE-2026-60000](https://cve.now/CVE-2026-60000.md): sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempt (CVSS 3.7)
- [CVE-2026-59999](https://cve.now/CVE-2026-59999.md): In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not. (CVSS 5.9)
- [CVE-2026-59998](https://cve.now/CVE-2026-59998.md): sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windo (CVSS 4.8)
- [CVE-2026-59997](https://cve.now/CVE-2026-59997.md): internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-l (CVSS 4.2)
- [CVE-2026-59996](https://cve.now/CVE-2026-59996.md): scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destina (CVSS 4.2)
- [CVE-2026-59995](https://cve.now/CVE-2026-59995.md): sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker (CVSS 4.2)
- [CVE-2026-57589](https://cve.now/CVE-2026-57589.md): sys/kern/sysv\_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. (CVSS 7.4)
- [CVE-2026-56099](https://cve.now/CVE-2026-56099.md): OpenBSD mpls\_do\_error Kernel Stack Memory Disclosure via MPLS Input (CVSS 6.9)
- [CVE-2026-55706](https://cve.now/CVE-2026-55706.md): sppp\_pap\_input in sys/net/if\_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths. (CVSS 5.8)
- [CVE-2026-41285](https://cve.now/CVE-2026-41285.md): In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option ( (CVSS 4.3)
- [CVE-2026-35414](https://cve.now/CVE-2026-35414.md): OpenSSH before 10.3 mishandles the authorized\_keys principals option in uncommon scenarios involving a principals list in conjunction with a (CVSS 4.2)
- [CVE-2026-35388](https://cve.now/CVE-2026-35388.md): OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. (CVSS 2.5)
- [CVE-2026-35387](https://cve.now/CVE-2026-35387.md): OpenSSH before 10.3 can use unintended ECDSA algorithms. (CVSS 3.1)
- [CVE-2026-35386](https://cve.now/CVE-2026-35386.md): In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. (CVSS 3.6)
- [CVE-2026-35385](https://cve.now/CVE-2026-35385.md): In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the (CVSS 7.5)
- [CVE-2025-61985](https://cve.now/CVE-2025-61985.md): ssh in OpenSSH before 10.1 allows the '\\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. (CVSS 3.6)
- [CVE-2025-61984](https://cve.now/CVE-2025-61984.md): ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially… (CVSS 3.6)
- [CVE-2025-32728](https://cve.now/CVE-2025-32728.md): In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent (CVSS 4.3)
- [CVE-2025-30334](https://cve.now/CVE-2025-30334.md): OpenBSD wg(4) kernel crash (CVSS 6.5)
- [CVE-2024-11149](https://cve.now/CVE-2024-11149.md): OpenBSD vmm GDTR limits (CVSS 6.2)
- [CVE-2024-10933](https://cve.now/CVE-2024-10933.md): OpenBSD readdir directory traversal (CVSS 4.1)
- [CVE-2024-11148](https://cve.now/CVE-2024-11148.md): OpenBSD httpd(8) null dereference (CVSS 7.5)
- [CVE-2024-10934](https://cve.now/CVE-2024-10934.md): OpenBSD NFS double-free vulnerability (CVSS 9.8)
- [CVE-2021-35000](https://cve.now/CVE-2021-35000.md): OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability (CVSS 3.3)
- [CVE-2021-34999](https://cve.now/CVE-2021-34999.md): OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability (CVSS 3.8)
- [CVE-2023-52558](https://cve.now/CVE-2023-52558.md): OpenBSD 7.4 and 7.3 m\_split() network buffer kernel crash (CVSS 7.5)
- [CVE-2023-52557](https://cve.now/CVE-2023-52557.md): OpenBSD 7.3 invalid l2tp message npppd crash (CVSS 7.5)
- [CVE-2023-52556](https://cve.now/CVE-2023-52556.md): OpenBSD 7.4 pf state race condition kernel crash (CVSS 6.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/openbsd
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.