Patches for the OpenBSD base system are distributed as unified diffs.
Each patch is cryptographically signed with the
signify(1) tool and contains
usage instructions.
All the following patches are also available in one
tar.gz file
for convenience.
Alternatively, the syspatch(8)
utility can be used to apply binary updates.
Full binary updates are made available on the following architectures:
amd64, i386, arm64.
On other architectures, only machine-independent updates are produced (and
these are exceedingly rare).
Patches for supported releases are also incorporated into the
-stable branch.
003: RELIABILITY FIX: May 10, 2025All architectures
Replace incorrect zoneinfo files created by broken zic(8).
A source code patch exists which remedies this problem. This is a machine-independent patch, so syspatches are made available for all architectures (not just amd64, arm64, i386). Please run syspatch(8) on those machines to get the new zoneinfo files.
005: RELIABILITY FIX: June 17, 2025All architectures
In acme-client(1), handle as yet unobserved "processing" state when
fetching an issued certificate by retrying instead of giving up.
A source code patch exists which remedies this problem.
011: SECURITY FIX: October 28, 2025All architectures
Use-after-free and integer overflow in the Xkb and Present X server
extensions. CVE-2025-62229 CVE-2025-62230 CVE-2025-62231
A source code patch exists which remedies this problem.
013: RELIABILITY FIX: October 28, 2025All architectures
Ensure the group selected by a TLSv1.3 server for a HelloRetryRequest is
not one for which the client has already sent a key share.
A source code patch exists which remedies this problem.