Known Vulnerabilities for products from OpenBSD
Listed below are 20 of the newest known vulnerabilities associated with the vendor "OpenBSD".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-41285 json | Not Provided | 2026-04-21 | 2026-04-21 | |
| CVE-2026-35414 json | OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in con... | Not Provided | 2026-04-02 | 2026-04-10 |
| CVE-2026-33306 json | Not Provided | 2026-03-24 | 2026-03-24 | |
| CVE-2023-51385 json | 6.5 - MEDIUM | 2023-12-18 | 2024-03-13 | |
| CVE-2023-51384 json | 5.5 - MEDIUM | 2023-12-18 | 2024-03-13 | |
| CVE-2023-48795 json | 5.9 - MEDIUM | 2023-12-18 | 2024-03-13 | |
| CVE-2023-40216 json | OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incor... | 5.5 - MEDIUM | 2023-08-10 | 2023-08-23 |
| CVE-2023-38408 json | The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote cod... | 9.8 - CRITICAL | 2023-07-20 | 2023-11-07 |
| CVE-2023-38283 json | In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote... | 5.3 - MEDIUM | 2023-08-29 | 2023-09-07 |
| CVE-2023-35784 json | A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and i... | 9.8 - CRITICAL | 2023-06-16 | 2023-11-06 |
| CVE-2023-29323 json | ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-... | 7.8 - HIGH | 2023-04-04 | 2023-05-26 |
| CVE-2023-28531 json | ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earl... | 9.8 - CRITICAL | 2023-03-17 | 2023-12-22 |
| CVE-2023-27567 json | In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel. | 7.5 - HIGH | 2023-03-03 | 2023-04-06 |
| CVE-2022-48437 json | An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. x509_verify_ctx... | 5.3 - MEDIUM | 2023-04-12 | 2023-04-21 |
| CVE-2022-27882 json | slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow trig... | 7.5 - HIGH | 2022-03-25 | 2022-05-12 |
| CVE-2022-27881 json | engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement... | 7.5 - HIGH | 2022-03-25 | 2022-05-12 |
| CVE-2021-46880 json | x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error... | 9.8 - CRITICAL | 2023-04-15 | 2023-05-17 |
| CVE-2021-41617 json | sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation bec... | 7 - HIGH | 2021-09-26 | 2023-12-26 |
| CVE-2021-41581 json | x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer ov... | 5.5 - MEDIUM | 2021-09-24 | 2021-09-29 |
| CVE-2021-36368 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 3.7 - LOW | 2022-03-13 | 2023-11-07 |