OpenBSD 8.0 adds firewall hardening and vulnerability fixes
Original title: OpenBSD 8.0 Released With Enhanced Firewall Security and Critical Vulnerability Fixes
Errata also cover a remotely triggerable IPsec AES-GMAC kernel heap overflow on specific hardware; AES-GCM is unaffected.
OpenBSD 8.0, released October 20, 2026, updates PF, network daemons, virtualization, cryptography and core utilities. PF blocks crafted TCP resets and fixes several memory and parsing bugs, while httpd and relayd reject ambiguous request framing and default to a “secure” TLS cipher set. libexpat 2.8.4 addresses three CVEs, and BPF boundary checks are tied to CVE-2026-31912. Later errata include a remotely triggerable IPsec kernel heap overflow; administrators are told to review errata and use syspatch where supported.
Unconfirmed: The article does not say whether any of the fixed flaws are being exploited.
- This is the project’s 61st release, dated October 20, 2026.
- The IPsec flaw affects amd64 AES-NI and Octeon coprocessor systems.
- libexpat 2.8.4 fixes CVE-2026-66046, CVE-2026-76641 and CVE-2026-76957.
- Full binary updates are available for amd64, i386 and arm64.
- pax now blocks archives that extract files outside the working directory.
Impact: Remotely triggerable kernel heap overflow in specific IPsec setups
| Product | Affected | Fixed in |
|---|---|---|
| OpenBSD | 8.0; subsequent IPsec errata on amd64 AES-NI and Octeon | — |
| libexpat | — | 2.8.4 |
- 1.After installing OpenBSD 8.0, review errata and apply relevant fixes.
- 2.Use syspatch for supported binary updates on amd64, i386 and arm64.
- Vendors
- OpenBSD
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-31912 | Out-of-bounds read in libpcap BPF interpreter can crash packet-capture processes | 5.5 | <1% | ||
| CVE-2026-66046 | Unauthenticated DoS via Quadratic Complexity in Expat (libexpat) storeAtts() | 8.7 | <1% | PoC ×2 | |
| CVE-2026-76641 | Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity… | 8.7 | <1% | ||
| CVE-2026-76957 | libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks | 7.8 | <1% |
From the original article
2 min read at gbhackers.com
OpenBSD 8. 0 was released on October 20, 2026, marking the project’s 61st release. This update includes significant improvements, including enhanced firewall security, memory-safety fixes, stronger validation for network daemons, and security updates to core components.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.