OpenBSD 8.0 2026-yil 20-oktabrda chiqarildi — bu loyihaning 61-chi relizi. Ushbu yangilanish muhim yaxshilanishlarni o'z ichiga oladi, jumladan kuchaytirilgan xavfsizlik devori (firewall), xotira xavfsizligi tuzatishlari, tarmoq demonlari uchun kuchliroq tekshiruv va asosiy komponentlar uchun xavfsizlik yangilanishlari.
Asosiy yangilanishlar orasida PF — OpenBSD paket filtrlash devoriga kiritilgan yaxshilanishlar, shuningdek virtualizatsiya, kriptografik kutubxonalar va tizim yordamchi dasturlari bilan bog'liq zaifliklar tuzatishlari bor.
Administratorlar ushbu relizga kiritilgan funksiyalarni keyingi errata (tuzatishlar)dan farqlashi kerak. OpenBSD qo'shimcha yamoqlarni ham e'lon qildi, jumladan ma'lum apparat konfiguratsiyalariga ta'sir qiladigan masofadan ishga tushiriladigan IPsec yadro to'plami (heap) to'lib ketishi.
PF TCP reset paketlarining noto'g'ri ulanish holatlarini buzishiga yo'l qo'ymaslik choralarini joriy etdi. Ishlab chiquvchilar shuningdek ulanish hisoblagichlari poygasi (race) natijasida kamchilik (underflow) yuzaga kelishi mumkin bo'lgan muammolarni, chiquvchi paket yo'lidagi NULL ko'rsatkichni dereferensiya qilishni va pf_rule_copyin() funksiyasidagi chegaradan tashqari o'qishni tuzatdilar.
Bundan tashqari, xavfsizlik devori ioctl interfeyslarida tugallanmagan satrlarni rad etish va DIOCIGETIFACES funksiyasidagi birga kam (off-by-one) xatoni tuzatish ishlari bajarildi. Muvaffaqiyatsiz jadval biriktirishlari endi chaqiruvchining qoidalar to'plamini (ruleset) ozod qilmaydi, fragmentlarni qayta yig'ish esa IPv4 va IPv6 ishlov berish uchun to'g'ri marshrutlash domenida amalga oshiriladi.
Berkeley Packet Filter dvigateli CVE-2026-31912 bilan bog'liq dastur chegarasi tekshiruvlarini joriy etdi. Qo'shimcha tekshiruv endi ishlov berilmagan ko'rsatmalarni bloklaydi va chegaradan tashqari o'qishlarga olib kelishi mumkin bo'lgan butun son to'lib ketishi sharoitlari uchun mavjud tuzatishlarni to'ldiradi.
OpenBSD httpd endi noaniq CL.TE so'rov ramkalashini va eskirgan buklangan sarlavhalarni rad etadi. relayd xizmati takroriy Content-Length sarlavhalarini rad etish va chunked xabarlardan Content-Length ni olib tashlash uchun yangilandi. Ikkala xizmat ham o'zining standart TLS shifrlash konfiguratsiyasini "xavfsiz" (secure) ga o'zgartirdi.
iked demoni endi noto'g'ri va holatdan tashqari IKEv2 xabarlarini rad etadi. DHCP server yangilanishlari zararli manzil ma'lumotlaridan kelib chiqadigan ishdan chiqishlarni oldini oladi va DHCPINFORM so'rovlari natijasida yuzaga kelishi mumkin bo'lgan xotira tugashini kamaytiradi.
SMTP yaxshilanishlari imtiyoz ajratishni kuchaytiradi, shifrlangan navbat buferlarini tekshiradi va xavfli foydalanuvchi nomlarini, shuningdek tegishli kiritish maydonlaridagi karet qaytish va satr o'tish belgilarini rad etadi.
Ushbu reliz libexpat ni 2.8.4 versiyasiga yangilaydi va CVE-2026-66046, CVE-2026-76641 va CVE-2026-76957 zaifliklarini tuzatadi. Perl tuzatishlari Storable, pack va unpack funksiyalaridagi butun son to'lib ketishlarini qamrab oladi, shuningdek Socket 2.041 orqali tuzatilgan chegaradan tashqari to'plam (heap) o'qishi ham mavjud.
Virtualizatsiya yaxshilanishlari noto'g'ri ELF fayllarining vmd ning 32-bit va 64-bit yuklovchilarida chegaradan tashqari o'qishlarga sabab bo'lishini oldini oladi. Bundan tashqari, pax arxiv yordamchi dasturi endi zararli arxivlarning ishchi katalogdan tashqariga fayllarni chiqarishiga yo'l qo'ymaydi.
Eng muhim e'lon qilingan errata — IPsec bilan AES-GMAC ishlatilganda masofadan ishga tushiriladigan yadro to'plami (heap) to'lib ketishi.
Bu muammo AES-NI dan foydalanadigan amd64 tizimlari va kriptografik koprotsessordan foydalanadigan Octeon tizimlariga ta'sir qiladi; AES-GCM ta'sirlanmaydi. Qo'shimcha yamoqlar video drayveridagi foydalanishdan keyingi ozod qilish (use-after-free) muammosini, yadro xotira buzilishini va keyingi NSD zaifliklarini tuzatadi.
Administratorlar syspatch yordamida qo'llab-quvvatlanadigan ikkilik yangilanishlarni qo'llashlari mumkin. To'liq ikkilik yangilanishlar amd64, i386 va arm64 arxitekturalari uchun mavjud; boshqa arxitekturalar odatda manba kod yamoqlarini talab qiladi. Shuning uchun OpenBSD 8.0 ni o'rnatgandan so'ng, uning errata ro'yxatini ko'rib chiqing va tegishli tuzatishlarni qo'llang.
OpenBSD 8.0 was released on October 20, 2026, marking the project’s 61st release. This update includes significant improvements, including enhanced firewall security, memory-safety fixes, stronger validation for network daemons, and security updates to core components.
Key updates include enhancements to PF, OpenBSD’s packet filtering firewall, as well as fixes for vulnerabilities related to virtualization, cryptographic libraries, and system utilities.
Administrators should distinguish between the features included in this release and subsequent errata. OpenBSD has also published additional patches, including a remotely triggerable IPsec kernel heap overflow that affects specific hardware configurations.
PF has introduced measures to prevent crafted TCP reset packetsfrom incorrectly disrupting connection states. Developers have also addressed issues such as connection counter races that could lead to underflows, an outbound packet path NULL pointer dereference, and an out-of-bounds read in pf_rule_copyin().
Further fixes have been made to reject unterminated strings in firewall ioctl interfaces and rectify an off-by-one error in DIOCIGETIFACES. Failed table attachments no longer free the caller’s ruleset, and fragment reassembly now happens in the correct routing domain for both IPv4 and IPv6 processing.
The Berkeley Packet Filter engine has implemented program boundary checks linked to CVE-2026-31912. Additional validation now blocks unhandled instructions and complements existing fixes for integer overflow conditions that could result in out-of-bounds reads.
OpenBSD’s httpd now rejects ambiguous CL.TE request framing and obsolete folded headers. The relayd service has been updated to reject duplicate Content-Length headers and to remove Content-Length from chunked messages. Both services have switched their default TLS cipher configuration to “secure.”
The iked daemon now rejects malformed and out-of-state IKEv2 messages. DHCP server updates prevent crashes from malicious address data and reduce potential memory exhaustion from DHCPINFORM requests.
SMTP improvements enhance privilege separation, validate encrypted queue buffers, and reject unsafe usernames, as well as carriage return and line feed characters in relevant input fields.
This release updateslibexpat to version 2.8.4, addressing CVE-2026-66046, CVE-2026-76641, and CVE-2026-76957. Fixes for Perl cover integer overflows in Storable, pack, and unpack, along with an out-of-bounds heap read corrected through Socket 2.041.
Virtualization improvements prevent malformed ELF files from causing out-of-bounds reads in vmd’s 32-bit and 64-bit loaders. Additionally, the pax archive utility now prevents malicious archives from extracting files outside of the working directory.
The most significant published errata include a remotely triggerable kernel heap overflow when using IPsec with AES-GMAC.
This issue affects amd64 systems using AES-NI and Octeon systems using a cryptographic coprocessor; AES-GCM is not affected. Additional patches address a video driver use-after-free issue, kernel memory corruption, and further NSD vulnerabilities.
Administrators can apply supported binary updates using syspatch. Full binary updates are available for amd64, i386, and arm64 architectures; other architectures typically require source patches. Therefore, after installing OpenBSD 8.0, review its errata and apply the relevant fixes.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.