OpenBSD Makers of OpenBSD operating system, LibreSSL and OpenSSH

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any OpenBSD product.

RSS Feeds for OpenBSD security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in OpenBSD products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by OpenBSD Sorted by Most Security Vulnerabilities since 2018

OpenBSD OpenSSH82 vulnerabilities
SSH Server Implementation

OpenBSD57 vulnerabilities

OpenBSD LibreSSL6 vulnerabilities
Crypto Library

OpenBSD Opensmtpd1 vulnerability

Known Exploited OpenBSD Vulnerabilities

The following OpenBSD vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
OpenSMTPD Remote Code Execution Vulnerability	smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session. CVE-2020-7247 Exploit Probability: 98.9%	March 25, 2022

The vulnerability CVE-2020-7247: OpenSMTPD Remote Code Execution Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 17 vulnerabilities in OpenBSD with an average score of 5.0 out of ten. Last year, in 2025 OpenBSD had 12 security vulnerabilities published. That is, 5 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.58

Year	Vulnerabilities	Average Score
2026	17	4.99
2025	12	5.57
2024	14	7.95
2023	15	6.95
2022	3	6.23
2021	6	6.14
2020	5	7.70
2019	12	6.52
2018	6	6.16

It may take a day or so for new OpenBSD vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent OpenBSD Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-60002	Jul 08, 2026	OpenSSH <=10.3 Use-After-Free via Host Key Change (ssh) ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)	OpenSSH
CVE-2026-60001	Jul 08, 2026	OpenSSH sshd min auth delay bypass before 10.4 sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.	OpenSSH
CVE-2026-60000	Jul 08, 2026	OpenSSH <10.4 GSSAPI MaxAuthTries DoS sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.	OpenSSH
CVE-2026-59999	Jul 08, 2026	OpenSSH<10.4 DisableForwarding fails to block PermitTunnel In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.	OpenSSH
CVE-2026-59998	Jul 08, 2026	OpenSSH sshd GSSAPIStrictAcceptorCheck Misconfig Pre-10.4 on AD sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.	OpenSSH
CVE-2026-59997	Jul 08, 2026	OpenSSH <=10.3 internal-sftp accepts only first 9 args internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.	OpenSSH
CVE-2026-59996	Jul 08, 2026	OpenSSH <10.4 SCP Path Traversal Remote Files Pushed to Parent Directory scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.	OpenSSH
CVE-2026-59995	Jul 08, 2026	OpenSSH SFTP Server Path Constraint Flaw <10.4 sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.	OpenSSH
CVE-2026-57589	Jun 25, 2026	OpenBSD 7.9 sysv_sem.c Use-After-Free CAUSE Priv Esc sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().	Openbsd
CVE-2026-56099	Jun 18, 2026	OpenBSD Kernel OOB Read via MPLS frames (CVE-2026-56099) OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.