OpenBSD 8.0 was released on October 20, 2026, introducing enhanced security across its kernel, network services, cryptographic libraries, and software update infrastructure This article explores libtls openssh. . The project's 61st release includes OpenSSH 10.6 and LibreSSL 4.4.0, alongside expanded virtualization capabilities and architecture updates.
Its cryptographic changes include experimental support for composite post-quantum SSH signatures and a preferred hybrid key exchange group for TLS 1.3 connections in libtls.
OpenSSH includes signature malleability and public-key validity checks for Ed25519 verification, while removing some key-parsing and verification paths from the pre-authentication attack surface. Additional SSH fixes disable the LZ77 dictionary coder to prevent potential side-channel leaks and ensure ChannelTimeout and RekeyLimit settings apply correctly. It also fixes parsing of X.509 name constraints, reduces buffered DTLS handshake messages, and addresses an OCSP responder authorization bypass affecting clients requiring stapled responses.
Kernel updates address integer overflow in KERN_PROC_ARGS processing, disclose information through ELF structures, and mitigate weaknesses in executable path handling. The pf firewall addresses an out-of-bounds read, null pointer dereference, and connection counter race conditions, ensuring crafted TCP reset packets do not improperly destroy connection state. HTTP handling becomes stricter across httpd and relayd.
Changes reject ambiguous request framing, obsolete folded headers, and duplicate Content-Length headers in relevant components, while switching default TLS cipher policies to enhance security.
