Patches for the OpenBSD base system are distributed as unified diffs.
Each patch is cryptographically signed with the
signify(1) tool and contains
usage instructions.
All the following patches are also available in one
tar.gz file
for convenience.
Alternatively, the syspatch(8)
utility can be used to apply binary updates on the following architectures:
amd64, i386, arm64.
Patches for supported releases are also incorporated into the
-stable branch.
001: SECURITY FIX: October 14, 2024All architectures
Querying a maliciously constructed DNS zone could result in degraded
performance or denial of service. CVE-2024-8508
A source code patch exists which remedies this problem.
008: SECURITY FIX: February 18, 2025All architectures
sshd(8) denial of service relating to SSH2_MSG_PING handling.
ssh(1) server impersonation when VerifyHostKeyDNS enabled.
A source code patch exists which remedies this problem.
009: SECURITY FIX: February 25, 2025All architectures
Multiple X server issues.
CVE-2025-26594 CVE-2025-26595 CVE-2025-26596 CVE-2025-26597
CVE-2025-26598 CVE-2025-26599 CVE-2025-26600 CVE-2025-26601
A source code patch exists which remedies this problem.
013: SECURITY FIX: April 9, 2025All architectures
sshd(8) fix the DisableForwarding directive, which was failing to
disable X11 forwarding and agent forwarding as documented.
A source code patch exists which remedies this problem.
015: SECURITY FIX: April 13, 2025All architectures
In Perl, non-ASCII bytes in the left-hand-side of the `tr` operator
can overflow an insufficiently sized buffer. CVE-2024-56406
A source code patch exists which remedies this problem.
018: RELIABILITY FIX: June 17, 2025All architectures
In acme-client(1), handle as yet unobserved "processing" state when
fetching an issued certificate by retrying instead of giving up.
A source code patch exists which remedies this problem.