---
title: "OpenBSD 8.0"
slug: openbsd-8-0
url: https://listedarticles.com/articles/openbsd-8-0
canonical_url: https://www.openbsd.org/80.html
content_type: changelog
language: en
published_at: 2026-10-20T00:00:00.000Z
updated_at: 2026-10-20T11:18:39.249Z
author: "OpenBSD"
authored_by: human
publisher: "OpenBSD"
publisher_url: https://www.openbsd.org/
topics: ["OpenBSD", "Operating Systems", "Open Source", "Security"]
license: all-rights-reserved
word_count: 6144
reading_minutes: 27
citation: "OpenBSD, OpenBSD. \"OpenBSD 8.0.\" 20 Oct 2026. https://www.openbsd.org/80.html (all-rights-reserved)"
# The full text follows. The web page shows an extract and sends readers
# to the source above; quote the citation and link the canonical URL.
---

# OpenBSD 8.0

> OpenBSD 8.0, the project's 61st release, shipped on October 20, 2026. Highlights include a 512G amd64 kernel virtual address space, arm64 hibernate support, RISC-V vector, AIA and Sstc support, sparc64 moving to LLVM and loongson retired, drm(4) updated to Linux 6.18.53 with Intel Arc A-Series support, MP guests in vmm, and refreshed packages and third-party components.

# OpenBSD 8.0

Released October 20, 2026. (61st OpenBSD release)

Copyright 1997-2026, Theo de Raadt.

8.0 Song: "[The Simps on AI](https://www.openbsd.org/lyrics.html#80)"

- See the information on [the FTP page](https://www.openbsd.org/ftp.html) for a list of mirror machines.
- Go to the `pub/OpenBSD/8.0/` directory on one of the mirror sites.
- Have a look at [the 8.0 errata page](https://www.openbsd.org/errata80.html) for a list of bugs and workarounds.
- See a [detailed log of changes](https://www.openbsd.org/plus80.html) between the 7.9 and 8.0 releases.

## What's New

This is a partial list of new features and systems included in OpenBSD 8.0.
For a comprehensive list, see the [changelog](https://www.openbsd.org/plus80.html) leading to 8.0.

- Platforms specific improvements:
  - [amd64](https://www.openbsd.org/amd64.html):
    - Raised the size of amd64 kernel virtual address space from 4G to 512G.
    - [pmap(9)](https://man.openbsd.org/pmap.9) direct map now placed at a random location.
    - Sped up swap encryption by using AES cpu instructions.
  - [arm64](https://www.openbsd.org/arm64.html):
    - Added hibernate support.
    - Sped up swap encryption by using AES cpu instructions.
    - Implemented bounce buffers.
  - [luna88k](https://www.openbsd.org/luna88k.html):
    - Fixed m88k multiple CMMU register writes.
    - Extended m88k kernel-mode CMMU fault handling to handle write protection faults.
    - Ensure luna88k m8820x\_initialize\_cpu() initializes logical CPU #0 on non-MP kernels.
    - Faster CMMU walk in luna88k m8820x\_cpu\_number().
  - [riscv64](https://www.openbsd.org/riscv64.html):
    - Detect CPU extensions and advertise those usable by userland through elf\_aux\_info(3) AT\_HWCAP and AT\_HWCAP2 queries.
    - Added kernel support for the 'V' vector extension.
    - Implemented bounce buffers.
    - Added support for RISC-V Advanced Interrupt Architecture; added [imsic(4)](https://man.openbsd.org/imsic.4) and [aplic(4)](https://man.openbsd.org/aplic.4) drivers.
    - Added kernel support for the Sstc timer extension.
  - [sparc64](https://www.openbsd.org/sparc64.html):
    - Added bounds check for the sparc64 relocation flags table.
    - Switched sparc64 to LLVM toolchain.
    - Improved memory alignment on SPARCV9.
  - Other [architectures](https://www.openbsd.org/plat.html):
    - Retired support for loongson architecture (not working with Clang 22).
    - Various RISC-V and MIPS bugfixes for LLVM.
    - Fixed encoding of hppa protection bits.
  - More platform specific changes can be found in the [hardware support](#hardware_support) section below.
- Various kernel improvements:
  - Fixed memory size calculation in [open\_wmemstream(3)](https://man.openbsd.org/open_wmemstream.3).
  - Fixed [semop(2)](https://man.openbsd.org/semop.2) semaphore id being destroyed/replaced during context switch.
  - Improved inactive page queue heuristics for pagedaemon swapping pages/freeing memory.
  - Added [getexecpath(3)](https://man.openbsd.org/getexecpath.3) to provide copy of the [elf(5)](https://man.openbsd.org/elf.5) program's execution path.
  - More preparations for larger disklabel.
- Suspend/Hibernate Support:
  - Enabled suspend/resume for [qwz(4)](https://man.openbsd.org/qwz.4).
  - Made [ufshci(4)](https://man.openbsd.org/ufshci.4) survive a suspend on the Samsung Galaxy Book4 Edge and HONOR MagicBook Art 14 Snapdragon.
  - Stopped waking a suspended laptop when lid is closed and machdep.lidaction=0.
  - Added a global sleep mode variable to distinguish hibernate from 'normal' suspend.
  - Added suspend/resume support for [qcuart(4)](https://man.openbsd.org/qcuart.4).
  - Added support for wakeup interrupts to [bytgpio(4)](https://man.openbsd.org/bytgpio.4), fixes IdeaPad resuming from suspend.
  - Validate size of chunks copied to piglet during hibernate unpacking of disk image.
  - Validate on-disk image sizes against integer overflow when reading chunks in unhibernate.
  - Prevent disk image overreads when reading the chunktable in unhibernate.
  - Clean up the framebuffer after unhibernate.
  - Made failure to allocate a dedicated queue for [nvme(4)](https://man.openbsd.org/nvme.4) hibernate support non-fatal.
- Direct Rendering Manager and graphics drivers:
  - Updated [drm(4)](https://man.openbsd.org/drm.4) to
    Linux 6.18.53.
  - Support for Intel Arc A-Series (DG2/Alchemist) graphics cards
    in [inteldrm(4)](https://man.openbsd.org/inteldrm.4).
  - Increased kernel virtual address space on amd64 allows mapping
    more than 4GB of VRAM.
  - Workaround
    [inteldrm(4)](https://man.openbsd.org/inteldrm.4)
    GuC timeout errors seen on some Alder Lake systems.
- VMM/VMD improvements:
  - Added MP support for up to 64 VCPUs per guest VM.
  - Redesigned to use files to manage VM ownership.
  - Added x2apic mode support for guest virtual machines.
  - Fix for when [vmd(8)](https://man.openbsd.org/vmd.8) does not detect kernel on startup.
  - Provide faulting GPA to [vmd(8)](https://man.openbsd.org/vmd.8) for MMIO exits from [vmm(4)](https://man.openbsd.org/vmm.4).
  - Refactored [vmm(4)](https://man.openbsd.org/vmm.4) exit handling and correct RIP adjustment.
  - Added support for variable length instructions in VMX paths to [vmm(4)](https://man.openbsd.org/vmm.4).
  - Prevent OOB reads by [vmd(8)](https://man.openbsd.org/vmd.8) in 32 and 64-bit [elf(5)](https://man.openbsd.org/elf.5) loaders with malformed [elf(5)](https://man.openbsd.org/elf.5) files.
  - Implemented missing lapic/ioapic modes to fix [vmd(8)](https://man.openbsd.org/vmd.8) support for 32-bit linux guests.
  - Added checksum offload for [vmd(8)](https://man.openbsd.org/vmd.8) guests.
  - MSI/MSI-X virtio device interrupt support added.
  - Support actually split split-virtqueues in [vmd(8)](https://man.openbsd.org/vmd.8).
  - Added i82093aa ioapic and i82489dx-compatible lapic emulation to [vmd(8)](https://man.openbsd.org/vmd.8).
  - Improved qcow handling.
- Various new userland features:
  - [netstat(1)](https://man.openbsd.org/netstat.1) can now print interface multicast counter; made '-q' more specific.
  - Adjusted [ddb(4)](https://man.openbsd.org/ddb.4) default 'ps' output, print 'struct process' and 'struct proc' separately.
  - Made [mount(8)](https://man.openbsd.org/mount.8) support DUIDs with -u; preserve DUID when updating file system.
  - Implemented control of midithru ports with [sndioctl(1)](https://man.openbsd.org/sndioctl.1).
  - Allow list elements to be added or removed by [sndioctl(1)](https://man.openbsd.org/sndioctl.1).
  - Added the [sndiod(8)](https://man.openbsd.org/sndiod.8) server.mode control making the setting dynamic, changeable via [sndioctl(1)](https://man.openbsd.org/sndioctl.1).
- More bugfixes and tweaks in userland:
  - Ensure [elf(5)](https://man.openbsd.org/elf.5) header and program header fit into the shared library when loading.
  - Fixed leak of key memory in [getpwent(3)](https://man.openbsd.org/getpwent.3) yp\_next().
  - In [patch(1)](https://man.openbsd.org/patch.1), solved an infinite loop on malformed [ed(1)](https://man.openbsd.org/ed.1) script input.
  - Use [execv(3)](https://man.openbsd.org/execv.3) absolute-path in [authpf(8)](https://man.openbsd.org/authpf.8), [pflogd(8)](https://man.openbsd.org/pflogd.8), [ldapd(8)](https://man.openbsd.org/ldapd.8), [ldpd(8)](https://man.openbsd.org/ldpd.8), [lpd(8)](https://man.openbsd.org/lpd.8), [radiusd(8)](https://man.openbsd.org/radiusd.8), [snmpd(8)](https://man.openbsd.org/snmpd.8).
  - [uaudio(4)](https://man.openbsd.org/uaudio.4) now tests the reported format and channels are usable.
  - Stopped [sndiod(8)](https://man.openbsd.org/sndiod.8) aborting if a MIDI endpoint connects with non-empty buffers.
  - Fixed two missing checks of file\_new() return value in [sndiod(8)](https://man.openbsd.org/sndiod.8).
  - Fixed [npppd(8)](https://man.openbsd.org/npppd.8) LCP MRU option handing.
  - Adjust [pstat(8)](https://man.openbsd.org/pstat.8) to return the pid of the session leader process; allow '-t -M' to work.
  - Made [eigrpd(8)](https://man.openbsd.org/eigrpd.8) validate the prefixlen to avoid overflow.
  - Made [sndiod(8)](https://man.openbsd.org/sndiod.8) allocate all midithru structures on the heap.
- Improved hardware support and driver bugfixes, including:
  - Enabled the GXTP7936 touchscreen on the Samsung Galaxy Book4 Edge.
  - Added support for the riscv64 K3 PCIe/USB3 combo PHY.
  - Enabled [gpioleds(4)](https://man.openbsd.org/gpioleds.4) on riscv64.
  - In [smte(4)](https://man.openbsd.org/smte.4) (SpacemiT K1 Ethernet device), improved error checking of received packets.
  - Fixed regular MSI interrupts on the SpacemiT K1 SoC.
  - Added support for the SpacemiT K3 SoC to [smtclock(4)](https://man.openbsd.org/smtclock.4).
  - Added SC7280 support to [qcgpio(4)](https://man.openbsd.org/qcgpio.4).
  - Added support for the SpacemiT K3 [dwpcie(4)](https://man.openbsd.org/dwpcie.4) PCIe controller.
  - Added RK3528 I2C5 clock, used in the Radxa E24C.
  - Added ACPI hardware IDS for Qualcomm Glymur (X2) SoC.
  - Implemented page table mirroring in [apldart(4)](https://man.openbsd.org/apldart.4); enable IOMMU for Apple USB controllers.
  - New [samsabi(4)](https://man.openbsd.org/samsabi.4) driver for
    the Samsung Advanced BIOS Interface (SABI).
  - New [sambat(4)](https://man.openbsd.org/sambat.4) driver for
    Samsung laptop battery monitor.
  - New [rkotp(4)](https://man.openbsd.org/rkotp.4) driver for
    Rockchip OTP memory.
  - Added support for the RK8600 regulator used for CPU voltage on Radxa Zero 3 boards.
  - Added more AMD "Krackan Point" device ids.
  - Fixed HONOR MagicBook Touchpad multitouch support.
  - Fixed [esp(4)](https://man.openbsd.org/esp.4) FIFO memory overflow.
  - Fixed potential memory leak in [softraid(4)](https://man.openbsd.org/softraid.4) rebuild.
  - Fixed [softraid(4)](https://man.openbsd.org/softraid.4) rebuild on disks with 4096-byte sectors.
  - Fixed high memory mbufs for 64-bit DMA capable [re(4)](https://man.openbsd.org/re.4).
- New or improved network hardware support:
  - Added support for Panther Lake and Wildcat Lake Ethernet devices to
    [em(4)](https://man.openbsd.org/em.4).
  - Added support for Intel E610 Ethernet devices to the [ix(4)](https://man.openbsd.org/ix.4) driver.
- Added or improved wireless network drivers:
  - Properly handle potential case of empty packets returned from [qwx(4)](https://man.openbsd.org/qwx.4) hardware.
  - Added missing DMA syncs for [qwx(4)](https://man.openbsd.org/qwx.4) SRNG DMA descriptor memory.
  - Properly handle [qwx(4)](https://man.openbsd.org/qwx.4) VIF DMA map allocation failures at attach time.
  - Fixed use of stale pointers on the [qwx(4)](https://man.openbsd.org/qwx.4) vif list which caused crashes.
  - Properly reset [qwx(4)](https://man.openbsd.org/qwx.4) driver and device state if it fails to get RUNNING in qwx\_init().
  - Avoid race condition in [qwx(4)](https://man.openbsd.org/qwx.4) device during power-on.
  - Use the ioctl rwlock correctly in [qwx(4)](https://man.openbsd.org/qwx.4) qwx\_activate().
  - Ensure [qwx(4)](https://man.openbsd.org/qwx.4) rx\_ring->bufs\_max and freemap are always initialised correctly.
  - Stopped [qwx(4)](https://man.openbsd.org/qwx.4) init task waiting for the ioctl lock to become available.
  - Made [qwx(4)](https://man.openbsd.org/qwx.4) properly errors which occur in qwx\_qmi\_fw\_init\_done().
  - Fixed roaming between APs with [qwx(4)](https://man.openbsd.org/qwx.4).
  - Always allow data frame interrupts in [qwx(4)](https://man.openbsd.org/qwx.4) while the interface is UP.
  - Added support for 40MHz channels to [qwx(4)](https://man.openbsd.org/qwx.4).
  - Made [qwx(4)](https://man.openbsd.org/qwx.4) only allocate a new mbuf when a free Rx ring slot is available.
  - Avoid calling bus\_dmamap\_create() from interrupt context in [qwx(4)](https://man.openbsd.org/qwx.4).
  - Handle country code events sent by [qwx(4)](https://man.openbsd.org/qwx.4) firmware to make association more reliable.
  - Reset [qwx(4)](https://man.openbsd.org/qwx.4) command ring 'queued' counter when the command ring gets reset.
  - Ensure that [qwx(4)](https://man.openbsd.org/qwx.4) nq flags are always cleared when switching net80211 state.
  - Fixed number of tx/rx streams set in [qwx(4)](https://man.openbsd.org/qwx.4) mac config.
  - Made [qwx(4)](https://man.openbsd.org/qwx.4) send the PMF good-bye deauth frame when hopping out of RUN state.
  - Ensure no new tasks get scheduled while IFF\_RUNNING is in qwx\_stop(). Prevents [qwz(4)](https://man.openbsd.org/qwz.4) crash.
  - Make [qwx(4)](https://man.openbsd.org/qwx.4) prefer ic\_bss over the ephemeral node in the scan tree.
  - Add peer to [qwx(4)](https://man.openbsd.org/qwx.4) firmware after starting the vdev, not before. Fixes a firmware crash.
  - Add 802.11n support to [qwx(4)](https://man.openbsd.org/qwx.4). Advertise HT capabilities and pass HT/QoS peer association.
  - Ask [qwx(4)](https://man.openbsd.org/qwx.4) firmware to move into M3 state before resetting the device.
  - Avoid calling bus\_dmamap\_destroy() from interrupt context in [qwx(4)](https://man.openbsd.org/qwx.4).
  - Added 802.11n with 40MHz width to [qwz(4)](https://man.openbsd.org/qwz.4).
  - Let [qwz(4)](https://man.openbsd.org/qwz.4) handle QoS in native WiFi frames.
- Installer, upgrade, bootloader, and pkg-tools improvements:
  - Harmonise [installurl(5)](https://man.openbsd.org/installurl.5) handling in [pkg\_add(1)](https://man.openbsd.org/pkg_add.1), [sysupgrade(8)](https://man.openbsd.org/sysupgrade.8), and [syspatch(8)](https://man.openbsd.org/syspatch.8).
  - Fixed free space check by [fw\_update(8)](https://man.openbsd.org/fw_update.8) for unqualified filenames.
  - Set limit on the size of files [fw\_update(8)](https://man.openbsd.org/fw_update.8) can download.
  - Stricter validation in [fw\_update(8)](https://man.openbsd.org/fw_update.8) to no longer treat untrusted comments as data.
  - [pkg\_add(1)](https://man.openbsd.org/pkg_add.1) now detects and overcomes some endless loops with merge-sets.
  - Clean trailing slashes from [fw\_update(8)](https://man.openbsd.org/fw_update.8) FWURL.
  - Removed current directory from default [pkg\_add(1)](https://man.openbsd.org/pkg_add.1) search path.
  - Improved downloading of firmware by filename in [fw\_update(8)](https://man.openbsd.org/fw_update.8).
  - Improved [fw\_update(8)](https://man.openbsd.org/fw_update.8) error when SHA256.sig is not found.
  - [fw\_update(8)](https://man.openbsd.org/fw_update.8) now checks signature of local SHA256.sig.
  - In [fw\_update(8)](https://man.openbsd.org/fw_update.8), made [tar(1)](https://man.openbsd.org/tar.1) skip files outside expected locations.
  - Stopped [syspatch(8)](https://man.openbsd.org/syspatch.8) downloading entire tgz file when looking for a potential update.
- Security improvements:
  - Fixed a [pledge(2)](https://man.openbsd.org/pledge.2) in [vfs(9)](https://man.openbsd.org/vfs.9).
  - Fixed out-of-bounds access attempts on [aplmca(4)](https://man.openbsd.org/aplmca.4) SOCs.
  - Stopped use of non-standard UID\_MAX and GID\_MAX in various utilities.
  - Improved [ipsec(4)](https://man.openbsd.org/ipsec.4) AES GMAC crypto.
  - Made [iked(8)](https://man.openbsd.org/iked.8) reject malformed and out-of-state IKEv2 messages.
  - Plugged memleak in x509\_verify (CID 656293).
  - Avoid overflow in [sysctl(2)](https://man.openbsd.org/sysctl.2) KERN\_PROC\_ARGS.
  - Prevent bogus or malicious iaddr data from crashing [dhcpd(8)](https://man.openbsd.org/dhcpd.8).
  - Avoid potential memory exhaustion via DHCPINFORM in [dhcpd(8)](https://man.openbsd.org/dhcpd.8).
  - Properly use saltlen and min\_saltlen in libcrypto RSA-PSS.
  - Reject invalid delta CRLs in libcrypto x509.
  - Fixed RFC 3779 inheritance handling in libcrypto's path validation.
  - Use [execve(2)](https://man.openbsd.org/execve.2) as $ORIGIN in [ld.so(1)](https://man.openbsd.org/ld.so.1) (otherwise fallback to realpath).
  - Hardened [syspatch(8)](https://man.openbsd.org/syspatch.8) against malicious scripts.
  - Restrict the characters that are allowed to pass through [smtpd(8)](https://man.openbsd.org/smtpd.8) environment and mda.
  - Fixed reading past the NUL by [pax(1)](https://man.openbsd.org/pax.1).
  - Stopped [pax(1)](https://man.openbsd.org/pax.1) extracting malicious archives outside the working directory.
  - Added 'mcast' to the [pledge(2)](https://man.openbsd.org/pledge.2) for [lldpd(8)](https://man.openbsd.org/lldpd.8).
  - Tightened pledge\_sockopt() level/optname checks for different types of sockets.
  - Extended the 'mcast' [pledge(2)](https://man.openbsd.org/pledge.2) to allow multicast tweaks on Ethernet frame sockets.
  - Updated libexpat to version 2.8.4 (CVE-2026-66046 CVE-2026-76641 CVE-2026-76957).
  - Avoid script pathname TOCTOU in exec when the vnode changes.
  - Made [execve(2)](https://man.openbsd.org/execve.2) realpath processing more robust.
  - Switched luna88k to build kernel files with -fno-pie.
  - Unprivileged kernel memory read and write vulnerability removed from m88k 88100 data pipeline.
  - [unveil(2)](https://man.openbsd.org/unveil.2) now restricts
    [man(1)](https://man.openbsd.org/man.1),
    [makewhatis(8)](https://man.openbsd.org/makewhatis.8), and
    [man.cgi(8)](https://man.openbsd.org/man.cgi.8)
    read and write access.
  - [dhcpleased(8)](https://man.openbsd.org/dhcpleased.8) now validates the IP address the dhcp server acks.
  - Fixed signed integer overflow in [perl(1)](https://man.openbsd.org/perl.1) Storable (CVE-2026-57433).
  - Fixed integer overflow in [perl(1)](https://man.openbsd.org/perl.1) pack and unpack (CVE-2026-57432).
  - Fixed [perl(1)](https://man.openbsd.org/perl.1) incorrect regular expression matches (CVE-2026-13221).
  - Fixed memory leaks and race condition in [profil(2)](https://man.openbsd.org/profil.2).
  - Improved checking of [elf(3)](https://man.openbsd.org/elf.3) notes; prevent out of bounds access.
  - Reject [elf(3)](https://man.openbsd.org/elf.3) interpreters without loadable segments.
  - Disable [kbind(2)](https://man.openbsd.org/kbind.2) and [pinsyscalls(2)](https://man.openbsd.org/pinsyscalls.2) for static binaries inside exec\_elf\_makecmds().
  - Fixed [elf(5)](https://man.openbsd.org/elf.5) structs to avoid leaking kernel stack contents.
  - LibXfont 2 fixes for CVE-2026-56001, CVE-2026-56002, and CVE-2026-56003.
  - [Xserver(1)](https://man.openbsd.org/Xserver.1) fixes for CVE-2026-55999 and CVE-2026-56000.
  - Updated [perl(1)](https://man.openbsd.org/perl.1) Socket to 2.041 (contains fix for CVE-2026-12087, out-of-bounds heap read).
  - Fixed [iked(8)](https://man.openbsd.org/iked.8) to [bzero(3)](https://man.openbsd.org/bzero.3) the mask data structure, rather than using mask4.
  - Fixes for CVE-2026-12244, CVE-2026-12245, CVE-2026-12246 and CVE-2026-12490 in [nsd(8)](https://man.openbsd.org/nsd.8).
  - Stopped leaking transport in [isakmpd(8)](https://man.openbsd.org/isakmpd.8) error paths of udp\_encap\_handle\_message().
  - Enforce per-type ID payload size in [isakmpd(8)](https://man.openbsd.org/isakmpd.8) ipsec\_validate\_id\_information().
  - Avoid shift overflows in [memmem(3)](https://man.openbsd.org/memmem.3) and [strstr(3)](https://man.openbsd.org/strstr.3).
  - Multiple additional bounds checks in [isakmpd(8)](https://man.openbsd.org/isakmpd.8).
  - Provide a separate executable file for [syslogd(8)](https://man.openbsd.org/syslogd.8) parent, for privilege separation.
  - Made [smtpd(8)](https://man.openbsd.org/smtpd.8) clear userinfo before sending over imsg.
  - Made [smtpd(8)](https://man.openbsd.org/smtpd.8) reject oversized sockaddr payloads received over privsep IPC.
  - Zero the temporary [smtpd(8)](https://man.openbsd.org/smtpd.8) envelope parsing buffers before use to strengthen privsep.
  - Clear pending asynchronous lookups at teardown, for stronger [smtpd(8)](https://man.openbsd.org/smtpd.8) privsep.
  - Fixed potential information leak from an uninitialised [ktrace(1)](https://man.openbsd.org/ktrace.1) stack variable.
- New features in the network stack:
  - Set [ice(4)](https://man.openbsd.org/ice.4) link state to full duplex.
  - Reduced maximum TSO segs in [ice(4)](https://man.openbsd.org/ice.4), to allow more interfaces to attach.
  - Enabled use of 128 DMA segments for TSO packets on [ice(4)](https://man.openbsd.org/ice.4).
  - Enabled 64-bit DMA for [bge(4)](https://man.openbsd.org/bge.4) BCM5720.
  - Enabled jumbo frames in [ogx(4)](https://man.openbsd.org/ogx.4).
- Further changes and bugfixes in the network stack:
  - Stopped [ipsec(4)](https://man.openbsd.org/ipsec.4) overflowing the maximum packet size in the IP header.
  - Detect out of bound reads from an int overflow in the [bpf(4)](https://man.openbsd.org/bpf.4) bpf\_mem backends.
  - Moved [bpf(4)](https://man.openbsd.org/bpf.4) for outgoing packets later in the transmit path.
  - Avoid leaking memory when mbuf chain allocations fail in [tun(4)](https://man.openbsd.org/tun.4) tun\_dev\_write().
  - Fixed hardmtu and rxmax in [ixl(4)](https://man.openbsd.org/ixl.4).
  - Handle dynamic channel width changes correctly in [iwx(4)](https://man.openbsd.org/iwx.4).
  - Hardened [bpf(4)](https://man.openbsd.org/bpf.4) bpf\_filter; block unhandled instructions with bpf\_validate.
  - Added proper program bound checks to the [bpf(4)](https://man.openbsd.org/bpf.4) engine (libpcap CVE-2026-31912).
  - Fixed bpf filter calls in [ppp(4)](https://man.openbsd.org/ppp.4); use [bpf\_mfilter(9)](https://man.openbsd.org/bpf_mfilter.9).
  - Improved imsg handling of LS\_UPD, LS\_FLOOD and LS\_SNAP in [ospfd(8)](https://man.openbsd.org/ospfd.8).
  - Changed [ospfd(8)](https://man.openbsd.org/ospfd.8) imsg handling.
  - [ospfd(8)](https://man.openbsd.org/ospfd.8) now adds missing rtlabel references and update routes when only the label changes.
  - Preserve configured interface type on [ospf6d(8)](https://man.openbsd.org/ospf6d.8) link update.
  - Ensure [ospfd(8)](https://man.openbsd.org/ospfd.8) does not leak information on memory address layout from process.
  - Made [authpf(8)](https://man.openbsd.org/authpf.8) read\_config() remove trailing white space to avoid misconfigurations.
  - Fixed [veb(4)](https://man.openbsd.org/veb.4) SIOCBRDGRTS and SIOCBRDGVRTS ioctls leaking kernel stack data.
  - Fixed packet corruption in [veb(4)](https://man.openbsd.org/veb.4).
  - [veb(4)](https://man.openbsd.org/veb.4) now returns ENOMEM when mallocarray() fails in veb\_rule\_list\_get().
  - Fixed [ifconfig(8)](https://man.openbsd.org/ifconfig.8) 'vebX -tagged ifX' which accepted too many arguments.
  - Improved [em(4)](https://man.openbsd.org/em.4) K1 exit timeout, to receive non-broadcast packets.
  - Simplified mac type tests on [em(4)](https://man.openbsd.org/em.4).
- The following changes were made to the [pf(4)](https://man.openbsd.org/pf.4) firewall:
  - Fixed off-by-one in [pf(4)](https://man.openbsd.org/pf.4) ioctl DIOCIGETIFACES.
  - Do not free the [pf(4)](https://man.openbsd.org/pf.4) caller's ruleset when attaching a table fails.
  - No longer allow un-terminated strings in [pf(4)](https://man.openbsd.org/pf.4) ioctl's.
  - Stopped [pf(4)](https://man.openbsd.org/pf.4) dropping valid MLD packets with unspecified source address.
  - Prevent [pf(4)](https://man.openbsd.org/pf.4) dropping TCP state if it receives a crafted reset packet.
  - Fixed races in [pf(4)](https://man.openbsd.org/pf.4) connection counters that caused connection counter underflows.
  - Fragment reassembly in [pf(4)](https://man.openbsd.org/pf.4)/[inet(4)](https://man.openbsd.org/inet.4)/[inet6(4)](https://man.openbsd.org/inet6.4) now occurs in correct routing domain.
  - Stopped 'pfctl -s all' dumping all OS fingerprints loaded to [pf(4)](https://man.openbsd.org/pf.4).
  - Fixed NULL pointer dereference in [pf(4)](https://man.openbsd.org/pf.4) outbound packet path.
  - Fixed out-of-bounds read in [pf(4)](https://man.openbsd.org/pf.4) pf\_rule\_copyin().
- Routing daemons and other userland network programs saw the following improvements:
  - Altered [smtpd(8)](https://man.openbsd.org/smtpd.8) code to avoid false bug reports from LLM scanners.
  - Prevent size\_t underflow on a malformed packets in [agentx(3)](https://man.openbsd.org/agentx.3) and [snmpd(8)](https://man.openbsd.org/snmpd.8).
  - Widen [httpd(8)](https://man.openbsd.org/httpd.8) server flags to 64-bit integers.
  - [httpd(8)](https://man.openbsd.org/httpd.8) now enforces 'max request body' for chunked requests passed to fastcgi.
  - Made [httpd(8)](https://man.openbsd.org/httpd.8) reject config of shared TLS listeners with different client CA or CRL.
  - In [httpd(8)](https://man.openbsd.org/httpd.8) now sends one imsg fastcgi param struct per parameter, to preserve config order.
  - Added custom HTTP header support to [httpd(8)](https://man.openbsd.org/httpd.8).
  - Fixed [httpd(8)](https://man.openbsd.org/httpd.8) suffix range handling.
  - Stopped [httpd(8)](https://man.openbsd.org/httpd.8) sending location fcgiparams twice.
  - Made [httpd(8)](https://man.openbsd.org/httpd.8) drain abort response via bufferevent to prevent errors being truncated.
  - Restricted IMSG\_CTL\_PROCFD to parent and check process id/instance in
    [iked(8)](https://man.openbsd.org/iked.8),
    [httpd(8)](https://man.openbsd.org/httpd.8),
    [relayd(8)](https://man.openbsd.org/relayd.8), and
    [snmpd(8)](https://man.openbsd.org/snmpd.8).
  - Switched the default TLS cipher in [httpd.conf(5)](https://man.openbsd.org/httpd.conf.5) set from 'compat' to 'secure.'
  - Made [httpd(8)](https://man.openbsd.org/httpd.8) and [dhcpd(8)](https://man.openbsd.org/dhcpd.8) correctly error check [timegm(3)](https://man.openbsd.org/timegm.3).
  - Random-relink [smtpd(8)](https://man.openbsd.org/smtpd.8) and [httpd(8)](https://man.openbsd.org/httpd.8) at boot.
  - [httpd(8)](https://man.openbsd.org/httpd.8) now rejects CL.TE request framing (per RFC 9112 sections 6.1 and 6.3).
  - Made [httpd(8)](https://man.openbsd.org/httpd.8) reject obs-fold with 400 (RFC 9112 5.2).
  - Fixed uploads using [httpd(8)](https://man.openbsd.org/httpd.8) chunked transfer-encoding.
  - [httpd(8)](https://man.openbsd.org/httpd.8) will now advertise Vary: Accept-Encoding whenever gzip-static is enabled.
  - Made [httpd(8)](https://man.openbsd.org/httpd.8) advertise static file revalidation, preserving Last-Modified and If-Modified-Since flow.
  - Added more config checks to [relayd(8)](https://man.openbsd.org/relayd.8).
  - Explicitly flush [relayd(8)](https://man.openbsd.org/relayd.8) redirect rules after reloading.
  - In [relayd(8)](https://man.openbsd.org/relayd.8), removed wrong disable flag for routers.
  - Use a per-host random ICMP echo id in [relayd(8)](https://man.openbsd.org/relayd.8).
  - Added Lua [patterns(7)](https://man.openbsd.org/patterns.7) support for [relayd(8)](https://man.openbsd.org/relayd.8) filter rules; improved [glob(7)](https://man.openbsd.org/glob.7) documentation.
  - Use [getexecpath(3)](https://man.openbsd.org/getexecpath.3) and [execv(3)](https://man.openbsd.org/execv.3) in [bgpd(8)](https://man.openbsd.org/bgpd.8) [eigrpd(8)](https://man.openbsd.org/eigrpd.8), [httpd(8)](https://man.openbsd.org/httpd.8), [iked(8)](https://man.openbsd.org/iked.8), [ntpd(8)](https://man.openbsd.org/ntpd.8), [relayd(8)](https://man.openbsd.org/relayd.8), and [smtpd(8)](https://man.openbsd.org/smtpd.8).
  - Fixed [relayd(8)](https://man.openbsd.org/relayd.8) deferring connections log.
  - Made [relayd(8)](https://man.openbsd.org/relayd.8) check proc\_compose and imsg\_compose\_event return values.
  - Allow setting log level from [relayd.conf(5)](https://man.openbsd.org/relayd.conf.5).
  - Added ECDSA support to the [relayd(8)](https://man.openbsd.org/relayd.8) CA privsep engine.
  - [relayd(8)](https://man.openbsd.org/relayd.8) now rejects duplicate Content-Length headers with 400.
  - Switched the default TLS cipher in [relayd.conf(5)](https://man.openbsd.org/relayd.conf.5) set from 'HIGH:!aNULL' to 'secure.'
  - Switched [relayd(8)](https://man.openbsd.org/relayd.8) to new imsg API.
  - Made [relayd(8)](https://man.openbsd.org/relayd.8) strip Content-Length for chunked messages (RFC 9112 section 6.1).
  - Made [relayd(8)](https://man.openbsd.org/relayd.8) reject obs-fold to prevent parser differentials (RFC 9112 5.2).
  - Removed [relayd(8)](https://man.openbsd.org/relayd.8) X509\_dup() call that leaks memory; add error checks for X509\_set\_\*.
  - In [relayd(8)](https://man.openbsd.org/relayd.8), added support for the MKCALENDAR HTTP method.
  - Fixed debug build of [relayd(8)](https://man.openbsd.org/relayd.8).
  - Let [relayd(8)](https://man.openbsd.org/relayd.8) support multiple resolvable addresses.
  - Let [relayd(8)](https://man.openbsd.org/relayd.8) handle HTTP responses without bodies.
  - Fixed NULL dereference in [isakmpd(8)](https://man.openbsd.org/isakmpd.8) message\_alloc\_reply() callers.
  - Fixed possible unaligned 32-bit read by [isakmpd(8)](https://man.openbsd.org/isakmpd.8).
  - Validate [isakmpd(8)](https://man.openbsd.org/isakmpd.8) DELETE payload SPI array size.
  - Validate proposal and transform sizes in [isakmpd(8)](https://man.openbsd.org/isakmpd.8).
  - Added length checks for the Port-Message and State attributes in [login\_radius(8)](https://man.openbsd.org/login_radius.8) Access-Challenge.
  - Prevent the [dhcpleased(8)](https://man.openbsd.org/dhcpleased.8) engine from sending us a negative amount of routes.
  - Made [dhcpleased(8)](https://man.openbsd.org/dhcpleased.8) accept correct amount of routes from the engine process.
  - Make sure [dhcpleased(8)](https://man.openbsd.org/dhcpleased.8) UDP header length field at least covers the UDP header.
  - Extended [smtpd(8)](https://man.openbsd.org/smtpd.8) mask-src to suppress session details.
  - Switched [smtpd(8)](https://man.openbsd.org/smtpd.8) over to [imsgbuf\_get(3)](https://man.openbsd.org/imsgbuf_get.3).
  - Free dispatcher in [smtpd(8)](https://man.openbsd.org/smtpd.8) mda\_envelope\_free() to avoid a leak.
  - [smtpd(8)](https://man.openbsd.org/smtpd.8) now rejects empty or slash-bearing usernames before building the mbox path.
  - [smtpd(8)](https://man.openbsd.org/smtpd.8) now rejects CR/LF in argv-derived fields before starting the SMTP enqueue dialogue.
  - Properly free the copied envelope on the [smtpd(8)](https://man.openbsd.org/smtpd.8) smarthost lookup failure path.
  - Properly free mda\_subaddress in [smtpd(8)](https://man.openbsd.org/smtpd.8) mda\_envelope\_free() to avoid memory leak.
  - Made [smtpd(8)](https://man.openbsd.org/smtpd.8) use inflateEnd() to tear down the inflate stream in uncompress\_gzip\_chunk().
  - [smtpd(8)](https://man.openbsd.org/smtpd.8) now stops parsing DNS answers once unpack\_rr() reports failure.
  - Validate encrypted [smtpd(8)](https://man.openbsd.org/smtpd.8) queue buffer sizes before processing auth tag and IV data.
  - Imported [rtrd(8)](https://man.openbsd.org/rtrd.8) RPKI-To-Router protocol daemon and [rtrctl(8)](https://man.openbsd.org/rtrctl.8).
  - [acme-client(1)](https://man.openbsd.org/acme-client.1) saw several changes:
    - Allow wildcards to be specified in alternate names in the [acme-client(1)](https://man.openbsd.org/acme-client.1) config.
    - Made [acme-client(1)](https://man.openbsd.org/acme-client.1) wipe optarg/eab/eab\_key with [freezero(3)](https://man.openbsd.org/freezero.3) after use.
    - Error check strdup() for external account binding by [acme-client(1)](https://man.openbsd.org/acme-client.1).
    - In [acme-client(1)](https://man.openbsd.org/acme-client.1), prevent HTTP request injection.
    - Let [acme-client(1)](https://man.openbsd.org/acme-client.1) handle '=' padding in base64url encoded EAB keys.
    - Fixed [timegm(3)](https://man.openbsd.org/timegm.3) invocations in [acme-client(1)](https://man.openbsd.org/acme-client.1).
    - Added support for [acme-client(1)](https://man.openbsd.org/acme-client.1) external account binding.
  - In [bgpd(8)](https://man.openbsd.org/bgpd.8):
    - Adjusted [bgpd(8)](https://man.openbsd.org/bgpd.8) graceful restart timer handling for multi-AFI/SAFI sessions.
    - Made [bgpd(8)](https://man.openbsd.org/bgpd.8) do a prefix re-evaluation if the validation state of a route changes.
    - Clear [bgpd(8)](https://man.openbsd.org/bgpd.8) NEXTHOP\_CONNECTED in nexthop\_update() if msg->connected is false.
    - Made [bgpd(8)](https://man.openbsd.org/bgpd.8) throttle reads from the peer when MSG\_PROCESS\_LIMIT reached.
    - Fixed [bgpd(8)](https://man.openbsd.org/bgpd.8) aspa\_table\_equal() equality comparison.
    - Incorporated new RTR v2 error codes from draft-ietf-sidrops-8210bis-26 to [bgpd(8)](https://man.openbsd.org/bgpd.8).
    - Reworked [bgpd(8)](https://man.openbsd.org/bgpd.8) IdleHoldTimer and how fast reconnects are implemented.
    - Reworked the force\_update logic in the [bgpd(8)](https://man.openbsd.org/bgpd.8) adj-rib-out.
    - Stopped [bgpd(8)](https://man.openbsd.org/bgpd.8) leaking peer data to [bgpctl(8)](https://man.openbsd.org/bgpctl.8).
    - Implemented ch\_meta\_locate() in [bgpd(8)](https://man.openbsd.org/bgpd.8).
    - Brought back the [bgpd(8)](https://man.openbsd.org/bgpd.8) path\_id\_tx hack for regular peers.
    - In [bgpd(8)](https://man.openbsd.org/bgpd.8), improved mrt\_dump\_entry\_mp() calculation handling, avoid overflow.
    - Avoid infinite loop when parsing PFKEY replies in [iked(8)](https://man.openbsd.org/iked.8), [isakmpd(8)](https://man.openbsd.org/isakmpd.8), [bgpd(8)](https://man.openbsd.org/bgpd.8), and [ldpd(8)](https://man.openbsd.org/ldpd.8).
    - Had [bgpd(8)](https://man.openbsd.org/bgpd.8) make sure the nexthop attribute is present if there is any nlri data.
    - Stopped [bgpd(8)](https://man.openbsd.org/bgpd.8) failing hard on version mismatch; ignore extra end-of-params messages.
    - Improved [bgpd(8)](https://man.openbsd.org/bgpd.8) handling of unknown extended communities.
    - Increased the [bgpd(8)](https://man.openbsd.org/bgpd.8) MRT attribute buffer to MAX\_EXT\_PKTSIZE so it works in all cases.
    - Fixed use-after-free in [bgpd(8)](https://man.openbsd.org/bgpd.8) rib\_remove and parse.y.
    - Added [bgpd(8)](https://man.openbsd.org/bgpd.8) force\_update flag to force pend\_prefix\_add() calls in adjout\_prefix\_update().
    - Made [bgpd(8)](https://man.openbsd.org/bgpd.8) respect RTR min-version in downgrade path and properly closing the connection.
    - Improved [bgpd(8)](https://man.openbsd.org/bgpd.8) add-path send parser. Error out if max is used with best.
    - Adjusted handling of limits in [bgpd(8)](https://man.openbsd.org/bgpd.8) up\_generate\_addpath().
    - Added extended message capability to checks for what the [bgpd(8)](https://man.openbsd.org/bgpd.8) peer has enabled.
    - Made [bgpd(8)](https://man.openbsd.org/bgpd.8) return an error on unhandled imsg types in the adj-rib-out case.
    - Fixed [bgpd(8)](https://man.openbsd.org/bgpd.8) port configuring on little endian systems.
    - Extra size checks for [bgpd(8)](https://man.openbsd.org/bgpd.8) ibuf\_set\_maxsize().
    - Introduce MAX\_ADDPATH\_COUNT (set to 100) and use this for the [bgpd(8)](https://man.openbsd.org/bgpd.8) add-path.
    - In [bgpd(8)](https://man.openbsd.org/bgpd.8) merge\_peers() also set local\_bgpid for cloned peers, not only regular peers.
    - Loop counters converted from uint8\_t to u\_int in [bgpd(8)](https://man.openbsd.org/bgpd.8).
    - Reduce maximum configurable stale time to CAPA\_GR\_TIMEMASK (4095) in [bgpd(8)](https://man.openbsd.org/bgpd.8).
    - In [bgpd(8)](https://man.openbsd.org/bgpd.8) session\_graceful\_restart() also arm the SessionDown timer.
    - Made [bgpd(8)](https://man.openbsd.org/bgpd.8) check xp->rdesession to know if the RDE has the session running or not.
    - Improved path\_calc\_hash() in [bgpd(8)](https://man.openbsd.org/bgpd.8).
    - Fixed 'treat as withdraw' handling for invalid [bgpd(8)](https://man.openbsd.org/bgpd.8) ORIGIN attributes.
    - Fixed two memory accounting issues in [bgpd(8)](https://man.openbsd.org/bgpd.8) chash.
    - Additional checks on TLV encoding in [bgpd(8)](https://man.openbsd.org/bgpd.8).
    - Limit all [bgpd(8)](https://man.openbsd.org/bgpd.8) ASPATH attributes to 750 elements.
    - In [bgpd(8)](https://man.openbsd.org/bgpd.8), prevent overflow of the uint8\_t length value in attr\_optadd.
    - Re-evaluate [bgpd(8)](https://man.openbsd.org/bgpd.8) prefixes if just PREFIX\_FLAG\_FILTERED changed.
  - In [rpki-client(8)](https://man.openbsd.org/rpki-client.8):
    - Fixed [rpki-client(8)](https://man.openbsd.org/rpki-client.8) to avoid buffer overreads with OpenSSL 4.1.
    - In [rpki-client(8)](https://man.openbsd.org/rpki-client.8), reject non-conformant certificate subject encodings.
    - Made [rpki-client(8)](https://man.openbsd.org/rpki-client.8) check alignment of certificate CRLDPs with the referring Manifest.
    - Reworked [rpki-client(8)](https://man.openbsd.org/rpki-client.8) cms\_parse\_validate().
    - Fixed handling of inherited resources in leaves by [rpki-client(8)](https://man.openbsd.org/rpki-client.8).
    - Unified all signed object parser functions in [rpki-client(8)](https://man.openbsd.org/rpki-client.8).
    - [rpki-client(8)](https://man.openbsd.org/rpki-client.8) now unconditionally warns about incorrect RSA parameters; rejects some malformed ROAs.
    - Limit the range of deltas added to the [rpki-client(8)](https://man.openbsd.org/rpki-client.8) queue.
    - Ensure consistent states in persistent [rpki-client(8)](https://man.openbsd.org/rpki-client.8) HTTP connections.
    - Removed behaviour difference between [rpki-client(8)](https://man.openbsd.org/rpki-client.8) versions with and without gbr support.
    - Fixed possible exit race in the [rpki-client(8)](https://man.openbsd.org/rpki-client.8) parser.
    - Made [rpki-client(8)](https://man.openbsd.org/rpki-client.8) only record NCA history on successful runs.
    - [rpki-client(8)](https://man.openbsd.org/rpki-client.8) will now only output config files on successful run.
    - Batch [rpki-client(8)](https://man.openbsd.org/rpki-client.8) retries of non-functional CAs based on their rsync base URI.
    - Properly apply constraints to [rpki-client(8)](https://man.openbsd.org/rpki-client.8) BGPsec Router certs.
    - Deduplicated [rpki-client(8)](https://man.openbsd.org/rpki-client.8) skiplist, shortlist, and NCA retry handling.
    - Removed incorrect free in [rpki-client(8)](https://man.openbsd.org/rpki-client.8) nca\_hist\_load().
    - In [rpki-client(8)](https://man.openbsd.org/rpki-client.8) cert\_ca\_sia(), use the correct notify string in error message.
    - Removed double fclose in a success path in [rpki-client(8)](https://man.openbsd.org/rpki-client.8).
    - Added a coinflip to increase cycle-to-cycle jitter in [rpki-client(8)](https://man.openbsd.org/rpki-client.8).
    - In [rpki-client(8)](https://man.openbsd.org/rpki-client.8), added a backoff retry mechanism for non-functional CAs.
    - [rpki-client(8)](https://man.openbsd.org/rpki-client.8) now rejects certs with duplicate extension OIDs.
    - Clear last\_modified after each response on a persistent HTTP [rpki-client(8)](https://man.openbsd.org/rpki-client.8) connection.
    - In [rpki-client(8)](https://man.openbsd.org/rpki-client.8), switch subordinates in CCR manifests to a simple queue.
    - Made [rpki-client(8)](https://man.openbsd.org/rpki-client.8) exclude hidden files and directories when synchronising via rsync.
    - In [rpki-client(8)](https://man.openbsd.org/rpki-client.8), limited the length of filenames in some ASN.1 fields to 255.
    - Fixed incomplete strncmp() check in [rpki-client(8)](https://man.openbsd.org/rpki-client.8).
    - Fix off-by-one in [rpki-client(8)](https://man.openbsd.org/rpki-client.8) ip\_addr\_check\_overlap().
    - Fixed shortlist and skiplist checks in [rpki-client(8)](https://man.openbsd.org/rpki-client.8).
    - Added more error checks and safeguards to [rpki-client(8)](https://man.openbsd.org/rpki-client.8).
- [tmux(1)](https://man.openbsd.org/tmux.1) improvements and bug fixes:
  - Keep the scroll position in tree mode when the list is rebuilt (issue 5631).
  - Do not leak waiting clients (in wait-for) if they are killed (issue 5614).
  - Do not cancel mark when a click is on the border.
  - Added support for borderless menus, like panes.
  - Added utf8 terminal-features.
  - Ignore focus events earlier to avoid them interfering with prefix.
  - Added -K flag to new-pane to make a modal pane capture all keys.
  - Always unzoom before splitting windows, including for floating panes.
  - Added 'T' to change pane title.
  - Added refresh-now command.
  - Ignore Ms if it is invalid (eg no %p1), report in client mode.
  - Fixed crash when synchronising groups and there is no current window.
  - Added pane\_private\_modes format with list of DEC private modes.
  - Prevented core dumps upon startup on landisk.
  - Added modal panes, created currently with new-pane -O.
  - Major rework of prompts.
  - Fixed cursor calculation when the status line is at the top.
  - Added -H flag to capture-pane to show hyperlinks.
  - Added -L to show line numbers with capture-pane and -F to show line flags.
  - Clear entire lines when removing from history or freeing.
  - Redraw entire session when making a new pane.
  - Added -g flag to kill-session to kill all sessions in a group.
  - Fixed crash when freeing layout cell.
  - Added missing argument to %unlinked-window-renamed.
  - Increase escape delay if the buffer contains a partial paste end.
  - Fixed crash caused by including unattached clients on sorted list.
  - Added new-pane command.
  - Fixed infinite loop due to underflow when redrawing scrollbar.
  - Fixed control mode teardown ordering for queued pane output.
  - Added Emacs-style re-centre-top-bottom.
  - Added time limits to some loops.
  - Added missing flags to screen\_mode\_to\_string.
- LibreSSL version 4.4.0:
  - Portable changes:
    - Numerous compatibility layer fixes for AIX, FreeBSD, macOS, MinGW, NetBSD, and especially Windows.
    - Fixed incorrect code generation by the MSVC ARM64 optimizer in
      constant-time bignum code.
    - Improved assembly support on many platforms.
    - Fixed [openssl(1)](https://man.openbsd.org/openssl.1),
      [nc(1)](https://man.openbsd.org/nc.1), and
      [ocspcheck(8)](https://man.openbsd.org/ocspcheck.8)
      silently running without
      [pledge(2)](https://man.openbsd.org/pledge.2) and
      [unveil(2)](https://man.openbsd.org/unveil.2)
      on hosts that provide them.
  - Internal improvements:
    - Minor code cleanup for PKCS#7.
    - Clear unused bits for the maximum of RFC 3779 IP address ranges.
    - Cleanup passes over the DTLS code, avoiding many contortions.
    - Zero out the failure\_key in ML-KEM code.
    - Improve portability in preprocessor based SHA assembly.
    - Removed a few vestigial #ifdefs from public and internal headers.
    - Introduce and use dtls12\_handshake\_msg framework.
    - Rename union from \_ to u in the ui code. Avoids Windows CE #ifdef.
    - Clean up and simplify signature algorithm handling after removal
      of TLSv1.0 and TLSv1.1.
    - Add a point at infinity check to ecdh\_compute\_key().
    - Fix incorrect purpose check in unreachable non-legacy path of the
      modern X.509 verifier.
    - Improve TLSv1.3 server handling of no shared groups.
    - Correct secondary key share handling for HelloRetryRequests.
    - Fix EXFLAG\_CRITICAL mishandling in the crl\_cb().
    - Among CRLs with the same score prefer the one with the most recent
      thisUpdate to match BoringSSL and OpenSSL behavior.
    - Clean up sequence number and message header handling in DTLS.
    - Remove redundant BIO\_write() length assertions in b64\_write().
    - Report invalid base64 BIO state as an internal error rather than
      asserting.
    - Improve SHA-3 performance by using an unrolled and interleaved
      algorithm.
    - Allocate TLSv1.3 receive buffers lazily.
    - Simplify handling of remaining record content on switch to the
      legacy stack.
    - Avoid harmless narrowing of the return value in dtls1\_ctrl().
    - Remove NID\_md5\_sha1 support from tls1\_PRF().
    - Remove DTLS unprocessed records queue.
    - Remove DTLS application data queue.
    - Remove SSL3\_FLAGS\_NO\_RENEGOTIATE\_CIPHERS which was never set.
  - Compatibility changes:
    - The misnamed tls\_peer\_cert\_chain\_pem() has been deprecated and may
      be removed in a future release. tls\_peer\_cert\_chain\_verified\_pem()
      and tls\_peer\_cert\_bundle\_unverified\_pem() should be used instead.
    - Use X25519MLKEM768 as the preferred group for TLSv1.3 connections
      in libtls.
    - Ensure libtls keeps working with future OpenSSL releases that will
      stop NUL-terminating ASN.1 strings. This is an old bug in libtls
      that will bite, probably starting with OpenSSL 4.2.
    - CRYPTO\_cleanup\_all\_ex\_data() is now a no-op. It was not thread
      safe and the actual cleanup is now done by [OPENSSL\_cleanup(3)](https://man.openbsd.org/OPENSSL_cleanup.3).
    - Align [X509\_check\_ca(3)](https://man.openbsd.org/X509_check_ca.3) with modern OpenSSL. While it has long been
      documented that it only works after calling
      [X509\_check\_purpose(3)](https://man.openbsd.org/X509_check_purpose.3),
      it still makes sense to "fail closed", i.e., indicate a non-CA.
    - Added OIDs for CCR, ErikIndex, ErikPartition, ErikSegmentIndex,
      and communityDefinition.
  - Bug fixes:
    - Fix [PKCS7\_set\_{un,}signed\_attributes(3)](https://man.openbsd.org/PKCS7_set_signed_attributes.3) to allow caller to free
      on failure rather than risking a double free.
    - Initialize decode\_error and invalid\_key variables in TLS key share
      code to avoid branching on uninitialized memory.
    - Record extension length between type and data in the ClientHello
      hash to ensure identical framing in first and second CH.
    - Fix out of bound writes in the s\_client XMSS mode.
    - Ensure [EC\_GROUP\_check(3)](https://man.openbsd.org/EC_GROUP_check.3) and
      [X509\_CRL\_verify(3)](https://man.openbsd.org/X509_CRL_verify.3) failures result in "app"
      failures in [openssl(1)](https://man.openbsd.org/openssl.1)
      ecparam and openssl crl.
    - Do not fail accept on reverse DNS lookup failures in s\_socket.
    - Ensure [X509V3\_EXT\_print(3)](https://man.openbsd.org/X509V3_EXT_print.3) only returns 0 and 1.
    - Avoid calling memcmp() on NULL in IPAddressFamily\_cmp().
    - In libtls disallow wildcard matching of a TLD specified as a FQDN.
    - Unbreak some aspects of TLSv1.2 with custom curve lists.
    - Ensure a peer-provided EC public key uses uncompressed encoding.
    - Send decode\_error alert on failure to decode an EC peer pubkey.
    - Avoid NULL dereference and out-of-bounds read in password-based
      CMS decryption.
    - Add some missing bounds check to ASN1\_mbstrinc\_copy().
    - Avoid freeing a caller-owned buffer in
      [PKCS7\_verify(3)](https://man.openbsd.org/PKCS7_verify.3).
    - Remove SSL\_OP\_LEGACY\_SERVER\_CONNECT from default options.
    - Send illegal parameter alerts for various HelloRetryRequest
      violations.
    - Check that the server selected ciphersuite is valid for use with
      TLSv1.2.
    - Unlock CRYPTO\_LOCK\_UI on ui\_open\_session() failure to avoid
      a deadlock.
    - Check [HMAC(3)](https://man.openbsd.org/HMAC.3)
      return value to avoid later use of uninitialized
      in [openssl(1)](https://man.openbsd.org/openssl.1).
    - Use correct alert for key\_share without supported\_groups.
    - Don't drop X509\_V\_ERR\_HOSTNAME\_MISMATCH when verify callback
      returns 1. It has long been documented that this is ill advised
      but some applications still do it.
    - Ensure the server selects an ALPN protocol that we advertised or
      abort the handshake with illegal\_parameter.
    - Fix streaming of PKCS#7 objects with omitted content.
    - Avoid OOB access due to type confusion in PKCS7\_stream().
    - Plug leak and various other bugs in asn1\_multi(), a helper to
      handle sequences and sets in config parsing.
    - Fix RFC 3779 inheritance checks for leaves as far as possible
      without breaking the RPKI. Still allow the immediate issuer to
      omit one of the extensions because otherwise about one third of
      RFC 9286 Manifests would become invalid.
    - Correct a botched size check in dtls1\_process\_fragment().
    - Avoid confusing delta CRLs as full CRLs.
    - When copying an RSA-PSS EVP\_PKEY\_CTX, ensure saltlen and minimal
      saltlen restrictions are copied rather than using the defaults.
    - Allow DTLS clients to receive unexpected Finished messages.
    - Cache the leaf's extensions before adding it to a validated
      chain to make name constraints check work more reliably.
    - Ensure the whole subject is searched for email addresses and
      common names.
    - Check for embedded NULs in emails and subjectAltname in the
      essentially unused legacy NAME\_CONSTRAINTS\_\*() API.
    - Remove support for nameRelativeToCRLIssuer in the CRL Distribution
      Point extension. Per RFC 5280 it SHOULD not be used by conforming
      CAs and it was eating memory for breakfast pre-signature.
  - Security and reliability fixes:
    - Fix parsing issues in X.509 name constraints URI host parsing.
      Handle IPv6 literals correctly and don't allow specially crafted
      userinfo to bypass host checks.
    - Limit size of buffered DTLS handshake messages to avoid overly
      large memory consumption on small handshake message fragments.
    - Fix an OCSP responder authorization bypass for clients using
      tls\_config\_ocsp\_require\_stapling(), of which only OpenBSD
      [nc(1)](https://man.openbsd.org/nc.1) and
      [ftp(1)](https://man.openbsd.org/ftp.1)
      are known when they're used with the "muststaple" key word.
  - Testing and proactive security:
    - Improved test coverage for DTLS and TLS renegotiation.
    - Add X.509 CRL regress from pre-Apache2-licensed BoringSSL.
    - Rework the testing framework to be memory based rather than
      file based. Match Go's output format more closely.
- OpenSSH 10.6:
  - Security fixes:
    - Disabled [ssh(1)](https://man.openbsd.org/ssh.1) LZ77 dictionary coder to avoid a potential side-channel leak.
    - Fixed ChannelTimeout and RekeyLimit not being applied in [sshd\_config(5)](https://man.openbsd.org/sshd_config.5).
    - Made [ssh(1)](https://man.openbsd.org/ssh.1) authorized\_keys "restrict" keyword apply correctly to tunnel forwarding.
  - Potentially incompatible changes:
    - Use IANA allocated codepoint for ssh-mldsa44-ed25519 instead of '@openssh.com'.
    - Made [sshd\_config(5)](https://man.openbsd.org/sshd_config.5) DisableForwarding=yes override PermitTunnel=yes.
    - Enforce a maximum size for usernames in [ssh-agent(1)](https://man.openbsd.org/ssh-agent.1) agent key use constraints.
    - Disallow NUL byte in [scp(1)](https://man.openbsd.org/scp.1) '-O filename'.
  - New features:
    - New [ssh-add(1)](https://man.openbsd.org/ssh-add.1) option '-P' to skip PIN entry (bz3635).
    - [ssh(1)](https://man.openbsd.org/ssh.1) signal handling with [readpassphrase(3)](https://man.openbsd.org/readpassphrase.3) fixed.
    - Switched [ssh(1)](https://man.openbsd.org/ssh.1) from supercop ed25519 to libsodium.
    - Extended [ssh(1)](https://man.openbsd.org/ssh.1) TCPKeepAlive to support forwardings (bz3921).
    - Added [ssh-keygen(1)](https://man.openbsd.org/ssh-keygen.1) 'hexdump' to dump the key blob in hex format.
    - Allow setting/clearing [ssh-keygen(1)](https://man.openbsd.org/ssh-keygen.1) touch-required/verify-required flags on FIDO private keys when resetting the passphrase.
    - Added [ssh(1)](https://man.openbsd.org/ssh.1) '-Z user@host' mode that lists pubkeys that will be tried for authentication.
    - Added experimental [ssh(1)](https://man.openbsd.org/ssh.1) support for composite post-quantum mldsa44-ed25519 signature scheme.
    - Added an explicit-seed variant of the [ssh(1)](https://man.openbsd.org/ssh.1) keygen function.
    - Added signature malleability and pubkey validity checks to [sshd(8)](https://man.openbsd.org/sshd.8) ed25519 verification.
  - Bugfixes:
    - Check [ssh(1)](https://man.openbsd.org/ssh.1) compressed payloads don't inflate beyond the maximum payload length.
    - Avoid race between multiple [ssh(1)](https://man.openbsd.org/ssh.1) processes establishing multiplexing control socket.
    - Plugged memory leak in [ssh-add(1)](https://man.openbsd.org/ssh-add.1) (CID 913600).
    - Fix for [ssh(1)](https://man.openbsd.org/ssh.1) CIDs 913601 and 913602.
    - Fix for [ssh(1)](https://man.openbsd.org/ssh.1) CID 913600.
    - Converted [ssh(1)](https://man.openbsd.org/ssh.1) channel timeouts to allow fractional and subsecond timeouts.
    - Made [ssh(1)](https://man.openbsd.org/ssh.1) masking signals correctly use sigaddset (bz3981).
    - Fixed [ssh(1)](https://man.openbsd.org/ssh.1) memleaks (CID 913598 and 913599); added missing semicolon (CID 913599).
    - Corrected Daylight Savings Time timestamp conversion by [ssh(1)](https://man.openbsd.org/ssh.1) (bz4004).
    - Fixed [ssh(1)](https://man.openbsd.org/ssh.1) proxy socket breakage in t-multiplex after recent [pledge(2)](https://man.openbsd.org/pledge.2) changes.
    - Reading server banner by [ssh-keyscan(1)](https://man.openbsd.org/ssh-keyscan.1) no longer blocks/freezes on a many-host keyscan.
    - Allow session-bind@openssh.com requests when the [ssh(1)](https://man.openbsd.org/ssh.1) agent is locked.
    - Avoid potential realloc use-after-free in the [ssh(1)](https://man.openbsd.org/ssh.1) client.
    - Reordering of certificates tried during [ssh(1)](https://man.openbsd.org/ssh.1) pubkey authentication.
    - Fixed [ssh(1)](https://man.openbsd.org/ssh.1) ML-KEM/ECDH interop problem.
    - Removed some key [ssh(1)](https://man.openbsd.org/ssh.1) parsing and verification paths from the pre-auth attack surface.
    - Avoid download to server-controlled path when performing [ssh(1)](https://man.openbsd.org/ssh.1) download via commandline.
    - Avoid possible NULL deref in [ssh(1)](https://man.openbsd.org/ssh.1); sanitise filenames received via remote glob.
    - Large refactoring of [sshd(8)](https://man.openbsd.org/sshd.8) config management code.
    - Made [sshd(8)](https://man.openbsd.org/sshd.8) force domain name received from the system resolver to lowercase.
    - Fixed two one-byte out-of-cound reads in [sshd(8)](https://man.openbsd.org/sshd.8).
    - Stricter validation of transport state passed from the preauth to postauth [sshd(8)](https://man.openbsd.org/sshd.8) process.
    - Fixed [ssh(1)](https://man.openbsd.org/ssh.1) client use-after-free on error path if cipher\_init() fails.
    - Added [ssh-agent(1)](https://man.openbsd.org/ssh-agent.1) -V to print version, use it to test the binary is functional after relinking.
    - Stopped [ssh(1)](https://man.openbsd.org/ssh.1) validating bad cipher/mac lists arguments as valid.
    - Fixed [ssh(1)](https://man.openbsd.org/ssh.1) NULL deref during pubkey auth.
    - Dropbear recently added a -Q option; make [ssh(1)](https://man.openbsd.org/ssh.1) use it to query KEX if available.
    - Classify [ssh(1)](https://man.openbsd.org/ssh.1) dynamic-tcpip channels as bulk, not interactive (bz3958).
- Ports and packages:

  Many pre-built packages for each architecture:

  - aarch64: 12907
  - amd64: 13060
  - arm: XXX
  - i386: 10659
  - mips64: 9072
  - powerpc: XXX
  - powerpc64: 9564
  - riscv64: 11116
  - sparc64: 10621

  Some highlights:

  - Asterisk 20.21.0 and 22.11.0
  - Audacity 3.7.9
  - CMake 4.3.5
  - Chromium 154.0.8037.92
  - Emacs 31.1
  - FFmpeg 9.0.2
  - GCC 16.1.0
  - GHC 9.10.3
  - GNOME 49
  - Go 1.27.1
  - JDK 11.0.32, 17.0.20, 21.0.12 and 25.0.4
  - KDE Gear 26.08.1
  - KDE Frameworks 6.30.0
  - KDE Plasma 6.7.5
  - Krita 6.0.3
  - LLVM/Clang 21.1.8 and 22.1.8
  - LibreOffice 26.8.0.3
  - Lua 5.1.5, 5.2.4, 5.3.6, 5.4.8 and 5.5.1
  - MariaDB 12.3.3
  - Mono 6.14.1
  - Mozilla Firefox 157.0 and ESR 153.4.0
  - Mozilla Thunderbird 153.4.0
  - Mutt 2.4.2 and NeoMutt 20260616
  - Node.js 24.21.0 and Deno 2.9.7
  - OCaml 4.14.2
  - OpenLDAP 2.6.15
  - PHP 8.3.33, 8.4.26 and 8.5.11
  - Postfix 3.5.28 and 3.11.7
  - PostgreSQL 18.6
  - Prism Launcher 11.1.0
  - Python 2.7.18 and 3.14.7
  - Qt 5.15.19 (+ kde patches) and 6.11.2
  - R 4.6.1
  - Ruby 3.3.12, 3.4.11 and 4.0.7
  - Rust 1.98.1
  - SQLite 3.53.2
  - Shotcut 26.8.1
  - Sudo 1.9.17p2
  - Suricata 7.0.7
  - Tcl/Tk 8.5.19, 8.6.18 and 9.0.4
  - TeX Live 2026
  - Vim 9.2.1125, Neovim 0.12.5 and Vim-Classic 2026091
  - Wayland 1.26.0 with compositors CoW, Labwc, Mango, Niri, Sway and Wayfire
  - Vulkan 1.4.357.0
  - Xfce 4.20.0
- As usual, steady improvements in manual pages and other documentation.
- The system includes the following major components from outside suppliers:
  - Xenocara (based on X.Org 7.7 with xserver 21.1.24 + patches,
    freetype 2.14.3, fontconfig 2.17.1, Mesa 25.0.7, xterm 410,
    xkeyboard-config 2.20, fonttosfnt 1.2.5 and more)
  - LLVM/Clang 22.1.6 (+ patches)
  - GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
  - Perl 5.42.3 (+ patches)
  - pkgconf 3.0.7
  - NSD 4.15.2
  - Unbound 1.26.1
  - Ncurses 6.4
  - Binutils 2.17 (+ patches)
  - GDB 6.3 (+ patches)
  - Awk 20250116
  - Expat 2.8.4
  - zlib 1.3.2 (+ patches)

*The full release page also covers per-platform installation, upgrading, source code and the ports tree: <https://www.openbsd.org/80.html>*