Patches for the OpenBSD base system are distributed as unified diffs.
Each patch is cryptographically signed with the
signify(1) tool and contains
usage instructions.
All the following patches are also available in one
tar.gz file
for convenience.
Alternatively, the syspatch(8)
utility can be used to apply binary updates on the following architectures:
amd64, i386, arm64.
Patches for supported releases are also incorporated into the
-stable branch.
001: SECURITY FIX: April 8, 2024All architectures
Fix multiple heap buffer overread and data leakage in the X11 server
Xi extension and use after free in the Render extension.
CVE-2024-31080 CVE-2024-31081 CVE-2024-31083
A source code patch exists which remedies this problem.
008: SECURITY FIX: September 17, 2024All architectures
Avoid possible mbuf double free in NFS client and server implementation.
Do not use uninitialized variable in error handling of NFS server.
A source code patch exists which remedies this problem.
011: SECURITY FIX: October 14, 2024All architectures
Querying a maliciously constructed DNS zone could result in degraded
performance or denial of service. CVE-2024-8508
A source code patch exists which remedies this problem.
017: SECURITY FIX: February 18, 2025All architectures
sshd(8) denial of service relating to SSH2_MSG_PING handling.
ssh(1) server impersonation when VerifyHostKeyDNS enabled.
A source code patch exists which remedies this problem.
018: SECURITY FIX: February 25, 2025All architectures
Multiple X server issues.
CVE-2025-26594 CVE-2025-26595 CVE-2025-26596 CVE-2025-26597
CVE-2025-26598 CVE-2025-26599 CVE-2025-26600 CVE-2025-26601
A source code patch exists which remedies this problem.
023: SECURITY FIX: April 9, 2025All architectures
sshd(8) fix the DisableForwarding directive, which was failing to
disable X11 forwarding and agent forwarding as documented.
A source code patch exists which remedies this problem.
025: SECURITY FIX: April 13, 2025All architectures
In Perl, non-ASCII bytes in the left-hand-side of the `tr` operator
can overflow an insufficiently sized buffer. CVE-2024-56406
A source code patch exists which remedies this problem.