OpenBSD

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 9.8CriticalJan 29, 2020OpenBSD OpenSMTPD Code / command injectionCVE-2020-7247smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.Added to KEV Mar 25, 2022 · 785 days after publicationExploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

Recent

• 5.9MediumOct 28, 2026OpenBSD LibreSSL Denial of serviceCVE-2026-118374LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.
• 3.7LowOct 28, 2026OpenBSD LibreSSL Information disclosureCVE-2026-118373LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.
• 3.7LowOct 28, 2026OpenBSD LibreSSLCVE-2026-118372LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
• 3.7LowOct 28, 2026OpenBSD LibreSSLCVE-2026-118371LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
• 5.0MediumJun 23, 2026Openbsd opensshCVE-2026-55655A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.
• 4.3MediumJun 23, 2026Openbsd openssh Memory corruptionCVE-2026-55653A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).
• 4.2MediumApr 2, 2026OpenBSD OpenSSHCVE-2026-35414OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.
• 5.5MediumDec 18, 2023Openbsd openssh Auth bypass / access controlCVE-2023-51384In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.
• 5.9MediumDec 18, 2023Openbsd opensshCVE-2023-48795The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connectio94% likelyNucleiDetection
• 9.8CriticalMar 17, 2023Openbsd openssh Auth bypass / access controlCVE-2023-28531ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.3% likely
• 9.8CriticalJan 29, 2020OpenBSD OpenSMTPD Code / command injectionCVE-2020-7247smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.Exploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 7.0HighSep 26, 2021Openbsd opensshCVE-2021-41617sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with gro2.5% likely

See every OpenBSD entry on the dashboard.

Top products

• LibreSSL4 CVEs in the last year
• OpenSSH3 CVEs in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• CISA · Oct 22, 2026Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFPCVE-2021-41617CVE-2023-28531CVE-2023-51384
• SonicWall PSIRT · Jan 16, 2024Prefix Truncation Attacks in SSH Specification (Terrapin Attack)CVE-2023-48795