OpenBSD 8.0 · Disclosed

OpenBSD 8.0 patches remotely triggerable IPsec heap overflow and nsd flaws

Nov 02, 2026 · 1 min read

OpenBSD published the first security errata for 8.0, days after the October 20 release. The update fixes nsd(8) in four CVEs, a remotely triggerable kernel heap overflow in IPsec with AES-GMAC, and a use-after-free in video(4). No exploitation reported; admins should apply the errata with syspatch(8).

By HIFY Radar newsroom Updated 11/02/2026 09:12 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

OpenBSD published the first security errata for version 8.0, days after the October 20 release. The update fixes the nsd DNS server in four CVEs, a remotely triggerable IPsec kernel flaw, and video driver bugs.

Why it matters

DNS servers running nsd and IPsec VPNs with AES-GMAC on affected hardware are exposed to a network-triggerable kernel flaw. The video driver has a use-after-free and kernel memory corruption. Systems on OpenBSD 8.0 without the errata remain exposed.

What to do

Apply the OpenBSD 8.0 security errata with syspatch(8). Prioritize servers running nsd and IPsec with AES-GMAC on amd64 with AES-NI or octeon with crypto coprocessor.

For the technical team

CVE: CVE-2026-101337, CVE-2026-101338, CVE-2026-101339, CVE-2026-101341
Affected: OpenBSD 8.0 (nsd, IPsec AES-GMAC, video(4)) · OpenBSD 8.0. The IPsec heap overflow occurs only on amd64 with AES-NI and octeon with crypto coprocessor; AES-GCM is not affected. CVEs assigned to nsd(8): CVE-2026-101337, CVE-2026-101338, CVE-2026-101339, CVE-2026-101341.
Exploitation: No exploitation or PoC reported in the sources. Disclosed by @DailyDarkWeb based on the official OpenBSD errata.
Fix: OpenBSD 8.0 security errata, applied with syspatch(8). nsd(8) receives fixes backported from version 4.15.3.
Vector: Kernel heap overflow in IPsec with AES-GMAC, triggerable remotely; requires amd64 with AES-NI or octeon with crypto coprocessor. video(4): use-after-free and kernel memory corruption. nsd(8): four CVEs with fixes backported from version 4.15.3. ppp(4): off-by-one out-of-bounds write, reliability fix.
More details: New dbupdate(8) utility refreshes /etc/ssl/cert.pem and zoneinfo. @DailyDarkWeb analyst note: patch first on servers running nsd or IPsec with AES-GMAC on affected hardware.