OpenBSD 8.0 adds hardening and later IPsec errata
First merged summary.
OpenBSD 8.0, released October 20, 2026, hardens PF, SSH and TLS; later errata cover an IPsec heap overflow.
OpenBSD published its 61st release, OpenBSD 8.0, on October 20, 2026, with fixes across the kernel, PF, network services and update tools. OpenSSH 10.6 adds experimental mldsa44-ed25519 signatures, moves that scheme to an IANA codepoint and disables the LZ77 dictionary coder over a possible side channel. LibreSSL 4.4.0 prefers X25519MLKEM768 in libtls and fixes an OCSP responder authorization bypass. PF blocks crafted TCP resets and fixes memory and parsing bugs, while httpd and relayd reject ambiguous request framing. libexpat 2.8.4 addresses three CVEs, and later errata describe a remotely triggerable IPsec AES-GMAC kernel heap overflow on amd64 AES-NI and Octeon systems; AES-GCM is unaffected.
- OpenBSD 8.0 is the project's 61st release, dated October 20, 2026.
- libexpat 2.8.4 fixes CVE-2026-66046, CVE-2026-76641 and CVE-2026-76957.
- BPF boundary checks are tied to CVE-2026-31912.
- IPsec AES-GMAC overflow affects amd64 AES-NI and Octeon; AES-GCM is unaffected.
- Full binary updates are available for amd64, i386 and arm64.
- pax blocks archives that extract files outside the working directory.
Timeline
dated events in the reporting · oldest first- Oct 20, 2026OpenBSD 8.0, the project's 61st release, is published · GBHackers
What each outlet adds
beyond the shared facts- GBHackersIPsec AES-GMAC errata, libexpat and BPF CVEs, and binary platforms.
- Cyber Security NewsOpenSSH 10.6, LibreSSL 4.4.0, kernel memory fixes and firmware checks.
- Vendors
- OpenBSD
Coverage
oldest first · one row per article · UTC- · 4d ago
GBHackersFirst report
OpenBSD 8.0 adds firewall hardening and vulnerability fixes
Errata also cover a remotely triggerable IPsec AES-GMAC kernel heap overflow on specific hardware; AES-GCM is unaffected.
- · 4d ago
Cyber Security News
OpenBSD 8.0 adds hardening and experimental post-quantum SSH
The October 20 release ships OpenSSH 10.6 and LibreSSL 4.4.0, including an OCSP authorization-bypass fix and kernel memory fixes.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-31912 | Out-of-bounds read in libpcap BPF interpreter can crash packet-capture processes | 5.5 | <1% | ||
| CVE-2026-66046 | Unauthenticated DoS via Quadratic Complexity in Expat (libexpat) storeAtts() | 8.7 | <1% | PoC ×2 | |
| CVE-2026-76641 | Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity… | 8.7 | <1% | ||
| CVE-2026-76957 | libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks | 7.8 | <1% |