Openbsd vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Openbsd flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2020-7247 OpenSMTPD Remote Code ExecutionExploited since Mar 25, 2022 · CVSS 9.8

Latest high and critical flaws

• CVE-2026-118374 LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP reHigh 8.2 · Oct 27, 2026
• CVE-2026-103547 In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client fCritical 9.2 · Sep 30, 2026
• CVE-2026-60002 ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange.High 7.7 · Jul 7, 2026
• CVE-2026-57589 sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root.High 7.4 · Jun 24, 2026
• CVE-2026-35385 In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performeHigh 7.5 · Apr 2, 2026
• CVE-2025-30334 In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash.High 7.1 · Mar 20, 2025
• CVE-2024-11148 In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request.High 8.7 · Dec 5, 2024
• CVE-2024-10934 In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitiCritical 9.2 · Nov 15, 2024
• CVE-2024-39894 OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming High 7.5 · Jul 2, 2024
• CVE-2024-29937 NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug thatCritical 9.8 · Apr 10, 2024
• CVE-2023-52558 In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after reHigh 7.5 · Mar 1, 2024
• CVE-2023-52557 In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length.High 7.5 · Mar 1, 2024
• CVE-2023-35784 A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x bCritical 9.8 · Jun 16, 2023
• CVE-2021-46880 x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chaiCritical 9.8 · Apr 14, 2023
• CVE-2023-27567 In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel.High 7.5 · Mar 3, 2023
• CVE-2022-27882 slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow triggerable by a crafted IPv6 router adHigh 7.5 · Mar 25, 2022
• CVE-2022-27881 engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement with more than seven nameservers.High 7.5 · Mar 25, 2022
• CVE-2019-25049 LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_print_ctx).High 7.1 · Jun 30, 2021
• CVE-2019-25048 LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_ctx and ASN1_item_print).High 7.1 · Jun 30, 2021
• CVE-2010-4816 It was found in FreeBSD 8.0, 6.3 and 4.9, and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of service of the ftpd serviHigh 7.5 · Jun 22, 2021
• CVE-2020-16088 iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches.Critical 9.8 · Jul 28, 2020
• CVE-2020-15778 scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument.High 7.4 · Jul 24, 2020
• CVE-2020-7247 OpenSMTPD Remote Code ExecutionExploited · Critical 9.8 · Jan 29, 2020
• CVE-2019-19726 OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMITHigh 7.8 · Dec 11, 2019
• CVE-2019-19522 OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the High 7.8 · Dec 4, 2019