By vendor

Openbsd vulnerabilities

Known CVEs affecting Openbsd products, prioritized by severity, with SEC.co remediation and detection guidance.

14 published vulnerabilities

• CVE-2026-60002HIGH 7.7

  OpenSSH clients before version 10.4 are vulnerable to a use-after-free memory error that occurs when a server changes its host key during the key re-exchange phase of an SSH connection. This defect allows an attacker to potentially read sensitive data or crash the client application. The vulnerability is triggered only on the client side and requires specific conditions during the key exchange negotiation to exploit.

• CVE-2026-57589HIGH 7.4

  A use-after-free vulnerability exists in OpenBSD's System V semaphore implementation that allows a local attacker with no special privileges to escalate to root access. The flaw occurs when a process calls semget() and enters a sleep state; under specific timing conditions during context switching, freed memory can be accessed, compromising system integrity. This is a local attack requiring code execution on the target system but no prior privileges.

• CVE-2026-60001MEDIUM 6.5

  OpenSSH versions before 10.4 contain a flaw in the sshd daemon where it fails to properly enforce a configured minimum delay between authentication attempts. This delay mechanism is designed to slow down brute-force attacks by forcing attackers to wait between each login try. When the delay is not honored, an attacker can attempt passwords or keys much faster than intended, making credential-based attacks more feasible. The vulnerability affects SSH servers running vulnerable OpenSSH versions.

• CVE-2026-59999MEDIUM 5.9

  OpenSSH versions before 10.4 contain a logic error where the DisableForwarding security setting fails to properly override the PermitTunnel setting. Administrators who configured DisableForwarding=yes expecting to block all forwarding features would find that tunnel functionality remains active if PermitTunnel was also enabled, potentially exposing the system to unauthorized network tunneling.

• CVE-2026-55706MEDIUM 5.8

  A flaw in OpenBSD's serialized-line-protocol (SPPP) implementation allows attackers on an adjacent network to bypass authentication by supplying specially crafted zero-length values during the PAP (Password Authentication Protocol) exchange. The vulnerability resides in the input validation logic of the sppp_pap_input function and requires local network access but no user interaction to exploit. Successful exploitation leads to unauthorized access to authenticated services, potentially compromising confidentiality, integrity, and availability.

• CVE-2026-56099MEDIUM 5.3

  OpenBSD systems running versions before commit 6a23123 (released 2026-06-18) are vulnerable to a memory disclosure flaw in their MPLS networking stack. An attacker on the network can send specially crafted MPLS frames to trigger an out-of-bounds read, potentially leaking sensitive data from the kernel's memory. This is a remote attack requiring no authentication or user interaction, but the impact is limited to information disclosure—no system compromise or denial of service.

• CVE-2026-55655MEDIUM 5.0

  OpenSSH on Linux has a vulnerability that allows a local attacker to intercept and potentially manipulate X11 graphical display traffic forwarded over SSH. By pre-creating a socket file in a predictable location, an unprivileged user on the same machine can hijack the connection before the SSH client establishes it, gaining access to sensitive window contents, keyboard input, and other display data. The attack requires the victim to have X11 forwarding enabled and an active SSH session, but does not require elevated privileges.

• CVE-2026-59998MEDIUM 4.8

  OpenSSH versions before 10.4 contain an undocumented security behavior where the GSSAPIStrictAcceptorCheck setting fails to function correctly when the SSH server is configured with Windows Active Directory authentication. This means servers relying on this setting for access control may not enforce the intended security checks, potentially allowing unauthorized access or credential exposure in Windows AD environments.

• CVE-2026-55653MEDIUM 4.3

  A vulnerability exists in OpenSSH where a malicious SSH server can trigger a double-free memory error in the client during Diffie-Hellman Group Exchange (DH-GEX) parameter validation in FIPS mode. When an SSH client connects to a compromised or attacker-controlled server, the server can send specially crafted DH-GEX parameters that cause the client process to crash, resulting in a denial of service. This affects users and automated systems that initiate SSH connections to untrusted or compromised servers.

• CVE-2026-59995MEDIUM 4.2

  OpenSSH's SFTP client has a path traversal vulnerability affecting versions before 10.4. When a user downloads files from a server using the command "sftp server:/path ." (downloading to the current directory), an attacker controlling the SFTP server can craft malicious responses that cause files to be written outside the intended download location. This requires user interaction—specifically, the user must initiate the download command—and relies on the attacker operating a malicious SFTP server. The vulnerability allows file overwrite or creation in unintended directories, potentially compromising system integrity if critical files are targeted.

• CVE-2026-59996MEDIUM 4.2

  OpenSSH's scp command has a path traversal vulnerability that can cause files to be written to an unintended location when copying between two remote systems. If an attacker controls the source or destination in a remote-to-remote copy operation, they may be able to place a file in the parent directory of where it was supposed to go, potentially overwriting legitimate files or introducing malicious content into unexpected locations. This affects OpenSSH versions before 10.4.

• CVE-2026-59997MEDIUM 4.2

  OpenSSH's internal SFTP server has a parsing limitation where only the first 9 command-line arguments are processed. Any security-relevant parameters supplied as the 10th argument or beyond are silently ignored. This can lead to SFTP connections operating with weaker security properties than an administrator intended, since critical flags meant to restrict access or enforce specific protections would be overlooked during connection setup.

• CVE-2026-55654LOW 3.7

  OpenSSH has a flaw in how it cleans up authentication indicators when using GSSAPI (Kerberos-based authentication). The vulnerability is a heap memory read that goes out of bounds because the code expects a NULL terminator in an array that is missing. This causes the SSH daemon to crash when handling authentication in specific Kerberos environments, making the service temporarily unavailable. An attacker on the network can trigger this without authentication credentials, though it requires GSSAPI to be enabled and properly configured.

• CVE-2026-60000LOW 3.7

  OpenSSH versions before 10.4 contain a flaw in how they handle the MaxAuthTries configuration setting when GSSAPI authentication is enabled. An unauthenticated attacker on the network can send a large number of authentication requests to consume server resources, potentially degrading SSH service availability. The vulnerability requires specific conditions (GSSAPI must be configured) and has limited impact, but represents a denial-of-service vector that should be addressed during normal patching cycles.