OpenBSD 7.7 Errata

Patches for the OpenBSD base system are distributed as unified diffs. Each patch is cryptographically signed with the signify(1) tool and contains usage instructions. All the following patches are also available in one tar.gz file for convenience.

Alternatively, the syspatch(8) utility can be used to apply binary updates. Full binary updates are made available on the following architectures: amd64, i386, arm64. On other architectures, only machine-independent updates are produced (and these are exceedingly rare).

Patches for supported releases are also incorporated into the -stable branch.

• 001: SECURITY FIX: May 5, 2025   All architectures
  Kernel of NFS server could crash if nfsd(8) is enabled and an evil NFS request is sent to it.
  A source code patch exists which remedies this problem.

• 002: RELIABILITY FIX: May 10, 2025   All architectures
  Fix sign of UTC offset in some timezone files created by zic(8).
  A source code patch exists which remedies this problem.

• 003: RELIABILITY FIX: May 10, 2025   All architectures
  Replace incorrect zoneinfo files created by broken zic(8).
  A source code patch exists which remedies this problem.
  This is a machine-independent patch, so syspatches are made available for all architectures (not just amd64, arm64, i386). Please run syspatch(8) on those machines to get the new zoneinfo files.

• 004: RELIABILITY FIX: June 17, 2025   All architectures
  When using syncookies in pf(4), new TCP connections could run into timeout due to integer underflow.
  A source code patch exists which remedies this problem.

• 005: RELIABILITY FIX: June 17, 2025   All architectures
  In acme-client(1), handle as yet unobserved "processing" state when fetching an issued certificate by retrying instead of giving up.
  A source code patch exists which remedies this problem.

• 006: SECURITY FIX: June 17, 2025   All architectures
  Multiple X11 server issues. CVE-2025-49175 CVE-2025-49176 CVE-2025-49177 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180
  A source code patch exists which remedies this problem.

• 007: SECURITY FIX: July 1, 2025   All architectures
  Previous fix for X11 server was incomplete. CVE-2025-49176
  A source code patch exists which remedies this problem.

• 008: RELIABILITY FIX: July 1, 2025   All architectures
  TIOCUCNTL ioctl(2) could crash the kernel if called with a non-file argument.
  A source code patch exists which remedies this problem.

• 009: SECURITY FIX: September 30, 2025   All architectures
  In libexpat fix denial of service due to memory exhaustion. CVE-2025-59375 CVE-2024-8176
  A source code patch exists which remedies this problem.

• 010: SECURITY FIX: September 30, 2025   All architectures
  Fix out-of-bounds read and write, memory leaks and incorrect error check for CMS enveloped data.
  A source code patch exists which remedies this problem.

• 011: SECURITY FIX: October 28, 2025   All architectures
  Use-after-free and integer overflow in the Xkb and Present X server extensions. CVE-2025-62229 CVE-2025-62230 CVE-2025-62231
  A source code patch exists which remedies this problem.

• 012: SECURITY FIX: October 28, 2025   All architectures
  DNS cache poisoning vulnerabilities in unbound could lead to domain hijacking. CVE-2025-11411
  A source code patch exists which remedies this problem.

• 013: RELIABILITY FIX: October 28, 2025   All architectures
  Ensure the group selected by a TLSv1.3 server for a HelloRetryRequest is not one for which the client has already sent a key share.
  A source code patch exists which remedies this problem.

• 014: SECURITY FIX: October 31, 2025   All architectures
  smtpd(8) can die if a malformed imsg is sent on the local socket. CVE-2025-62875
  A source code patch exists which remedies this problem.

• 015: RELIABILITY FIX: December 3, 2025   All architectures
  Fix drm(4) to avoid spurious sleep errors leading to crashes.
  A source code patch exists which remedies this problem.

• 016: SECURITY FIX: December 3, 2025   All architectures
  Fix incorrect handling of invalid inputs to xkbcomp(1). CVE-2018-15853 CVE-2018-15859 CVE-2018-15861 CVE-2018-15863
  A source code patch exists which remedies this problem.

• 017: SECURITY FIX: December 3, 2025   All architectures
  Fix incomplete mitigation of DNS cache poisoning vulnerabilities in unbound. CVE-2025-11411
  A source code patch exists which remedies this problem.

• 018: RELIABILITY FIX: January 14, 2026   All architectures
  A malicious RPKI Trust Anchor can cause memory exhaustion.
  A source code patch exists which remedies this problem.

• 019: SECURITY FIX: February 2, 2026   All architectures
  Fix a use-after-free in httpd(8) when using chunked encoding.
  A source code patch exists which remedies this problem.

• 020: SECURITY FIX: February 9, 2026   All architectures
  In libexpat fix denial of service due to NULL dereference and integer overflow. CVE-2026-24515 CVE-2026-25210
  A source code patch exists which remedies this problem.

• 021: SECURITY FIX: February 27, 2026   All architectures
  Stop userland from using pledge(2) "tmppath" because the kernel feature will be removed soon.
  A source code patch exists which remedies this problem.

• 022: SECURITY FIX: February 27, 2026   All architectures
  sysctl requests blocked by pledge(2) create a diagnostic message which races inside pty(4) and possibly crashes.
  A source code patch exists which remedies this problem.

• 023: SECURITY FIX: March 2, 2026   All architectures
  In ldconfig(8), stop userland from using pledge(2) "tmppath" because the kernel feature will be removed soon.
  A source code patch exists which remedies this problem.

• 024: SECURITY FIX: March 4, 2026   All architectures
  Make the pledge(2) mechanism which permits specific libc paths more strict by removing the "tmppath" promise, avoid normalizing paths which libc already creates strictly correct, and blocking '..' traversals out of /usr/share/zoneinfo.
  A source code patch exists which remedies this problem.
  Ports that use pledge "tmppath" have to be adapted and rebuilt before rebooting.
  Affected are:
  • devel/got,-server
  • graphics/arcan
  • mail/opensmtpd-filters/dkimsign
  • math/moo
  • net/gmid
  • net/iperf3
  • security/pizauth
  • security/ruby-pledge,ruby33
  • sysutils/fzf
  • sysutils/rset
  • www/chromium
  • www/firefox-esr
  • www/iridium
  • www/mozilla-firefox
  • www/tor-browser/browser
  • www/ungoogled-chromium

• 025: SECURITY FIX: March 4, 2026   All architectures
  unveil(2) traversals could misbehave crossing mountpoints.
  A source code patch exists which remedies this problem.

• 026: SECURITY FIX: March 10, 2026   All architectures
  Prevent an integer overflow leading to out-of-bounds read in FreeType. CVE-2026-23865
  A source code patch exists which remedies this problem.

• 027: RELIABILITY FIX: March 10, 2026   All architectures
  Stop userland from using pledge(2) "tmppath" because the kernel feature has been removed.
  The calendar binary was missing from previous syspatch.

• 028: SECURITY FIX: March 15, 2026   All architectures
  pledge(2) "recvfd" should not kill a process who receives bad descriptors.
  A source code patch exists which remedies this problem.

• 029: RELIABILITY FIX: March 19, 2026   All architectures
  calendar(1) could not send mail due to missing unveil.
  A source code patch exists which remedies this problem.

• 030: RELIABILITY FIX: March 21, 2026   All architectures
  In libexpat fix denial of service due to NULL dereference and infinite loop. CVE-2026-32776 CVE-2026-32777 CVE-2026-32778
  A source code patch exists which remedies this problem.

• 031: RELIABILITY FIX: March 25, 2026   All architectures
  TCP packets with invalid SACK options could crash the kernel.
  A source code patch exists which remedies this problem.

• 032: RELIABILITY FIX: March 27, 2026   All architectures
  In smtpd(8), an LF character in the username or password could stop proc tables, causing a denial of service.
  A source code patch exists which remedies this problem.

• 033: SECURITY FIX: April 4, 2026   All architectures
  In iked(8) add stricter checks to avoid out-of-bounds read, NULL pointer dereference, and keep the state machine consistent.
  A source code patch exists which remedies this problem.

• 034: SECURITY FIX: April 14, 2026   All architectures
  Multiple vulnerabilites in the X server sync and Xkb extensions. CVE-2026-33999 CVE-2026-34000 CVE-2026-34001 CVE-2026-34002 CVE-2026-34003
  A source code patch exists which remedies this problem.

• 035: RELIABILITY FIX: April 14, 2026   All architectures
  rad(8) and slaacd(8) could spin doing nothing after a malformed packet.
  A source code patch exists which remedies this problem.

• 036: RELIABILITY FIX: April 14, 2026   All architectures
  A malicious RPKI Publication Server can cause an incorrect error exit. A malicious RRDP Publication Server can cause a NULL dereference.
  A source code patch exists which remedies this problem.

• 037: SECURITY FIX: April 17, 2026   All architectures
  pgrp management through a fork is unsafe.
  A source code patch exists which remedies this problem.

• 038: RELIABILITY FIX: April 21, 2026   All architectures
  libXpm out-of-bounds read. CVE-2026-4367
  A source code patch exists which remedies this problem.

• 039: RELIABILITY FIX: April 21, 2026   All architectures
  slaacd(8) could crash due to buffer overflow.
  A source code patch exists which remedies this problem.

• 040: SECURITY FIX: May 8, 2026   All architectures
  libexpat uses more entropy to protect against hash flooding. CVE-2026-41080
  A source code patch exists which remedies this problem.

• 041: RELIABILITY FIX: May 8, 2026   All architectures
  Due to insufficient checks in NFS server, the kernel could crash.
  A source code patch exists which remedies this problem.

• 042: SECURITY FIX: May 8, 2026   All architectures
  In iked(8), address sizes were not checked.
  A source code patch exists which remedies this problem.