Openbsd CVE-2025-30334

httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for

OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be

The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N

NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers

iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for chec

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiu

Authentication bypass in OpenBSD's sppp PAP handler (sppp_pap_input in sys/net/if_spppsubr.c) lets an adjacent attacker

Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code

Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with ke

OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to beco

xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH envir

In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is