Threat reportVulnerabilityTL-2026-4490
OpenBSD 8.0 Released With PF Firewall Hardening and Critical Vulnerability Fixes (incl. IPsec AES-GMAC Kernel Heap Overflow Erratum 003, CVE-2026-31912)
OpenBSD 8.0 Released With PF Firewall Hardening and Critical (TL-2026-4490), also tracked as OpenBSD 8.0 Errata 003, is a medium-severity software vulnerability, first published 2026-10-26. It has no confirmed attribution, affects OpenBSD OpenBSD kernel IPsec AES-GMAC (amd64 AES-NI, octeon), references 4 CVEs (CVE-2026-31912, CVE-2026-66046, CVE-2026-76641), maps to 2 MITRE ATT&CK techniques (T1190, T1499.004), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 2MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4490
- Threat ID
- TL-2026-4490
- Also known as
- OpenBSD 8.0 Errata 003, IPsec AES-GMAC kernel heap overflow
- Severity
- MEDIUM
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, telecoms, government administration, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in OpenBSD 8.0 Released With PF Firewall Hardening and Critical
Malware and tooling: XData
How OpenBSD 8.0 Released With PF Firewall Hardening and Critical works
OpenBSD 8.0 (61st release, 2026-10-20) fixes security issues in PF, bpf(4), httpd, relayd, iked, DHCP and bundled libexpat 2.8.4. Errata 003 fixes a remotely triggerable kernel heap overflow when IPsec uses AES-GMAC on amd64 (AES-NI) and octeon systems. No in-the-wild exploitation, public PoC, or KEV listing is reported.
OpenBSD 8.0, the 61st release, shipped on 2026-10-20 with a broad set of hardening changes and security fixes, and a patch-advisory-style set of errata published the same day.
Kernel / IPsec (Errata 003, 2026-10-20, patch 003_aesgmac.patch.sig): when IPsec is used with AES-GMAC, a kernel heap overflow can be triggered remotely. Only amd64 systems with AES-NI (sys/arch/amd64/amd64/aesni.c) and octeon systems with the crypto coprocessor (sys/arch/octeon/dev/octcrypto.c) are affected; AES-GCM is not. Per the patch, the driver sized its buffer from the encrypted-data length only, but wrote additional authenticated data (AAD, plus 4 bytes when ESN is used) into it; when AAD exceeds the data length the buffer is overrun. The fix allocates MAX(crd_len, aadlen). The errata page lists no CVE for this issue.
Packet filtering and network stack: PF fixes include an off-by-one in the DIOCIGETIFACES ioctl, rejection of un-terminated strings in pf(4) ioctls, an out-of-bounds read in pf_rule_copyin(), a NULL pointer dereference in outbound paths, a connection-counter race, and protection against crafted TCP reset packets disrupting connections. bpf(4) received hardening: detection of out-of-bounds reads from an int overflow in the bpf_mem backends, bpf_validate blocking of unhandled instructions, and program bound checks linked to libpcap CVE-2026-31912 (NVD: CVSS 3.1 5.5 MEDIUM, AV:L/PR:L, CWE-125/823/1285, libpcap before 1.10.7 BPF interpreter fails to detect the end of the filter program buffer or validate jump offsets).
Network daemons: httpd rejects ambiguous CL.TE framing (RFC 9112) and enforces a maximum body for chunked FastCGI requests; relayd rejects duplicate Content-Length and obs-fold headers; iked rejects malformed or out-of-state IKEv2 messages and adds bounds checks; isakmpd fixes a NULL dereference and validates DELETE payloads/proposal sizes; dhcpd and dhcpleased gain input validation against crashes and memory exhaustion via DHCPINFORM.
Third-party components: libexpat 2.8.4 addresses CVE-2026-66046 (quadratic complexity in storeAtts, CVSS 3.1 7.5, CWE-407), CVE-2026-76641 (out-of-bounds read via struct size mismatch with external entity parsers, CVSS 3.1 7.5, CWE-125) and CVE-2026-76957 (use-after-free from missing handler call depth tracking with custom encoding callbacks, CVSS 3.1 7.8, CWE-416). The release also carries Perl fixes (CVE-2026-57433, CVE-2026-57432, CVE-2026-13221), NSD fixes (CVE-2026-12244, -12245, -12246, -12490; errata 002), OpenSSH 10.6 and LibreSSL 4.4.0. Other errata: 001 PPP off-by-one (reliability), 004 video driver memory issues, 005 certificate database update (2026-10-23).
This is a patch advisory, not an active campaign. Systems are updated with syspatch (binary) or source patches on other architectures.
MITRE ATT&CK techniques used in TL-2026-4490
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in OpenBSD 8.0 Released With PF Firewall Hardening and Critical
- OpenBSD — OpenBSD kernel IPsec AES-GMAC (amd64 AES-NI, octeon)
Vulnerable versions: 8.0 before errata 003
Fixed in: 8.0 with 003_aesgmac applied - The Tcpdump Group — libpcap BPF interpreter
Vulnerable versions: before 1.10.7
Fixed in: 1.10.7 - libexpat — Expat XML parser
Vulnerable versions: through 2.8.3
Fixed in: 2.8.4
Remediation for OpenBSD 8.0 Released With PF Firewall Hardening and Critical
Patches
- OpenBSD 8.0 release (2026-10-20) with libexpat 2.8.4 and libpcap-linked bpf(4) bound checks
- Errata 001_ppp, 002_nsd, 003_aesgmac, 004_video, 005_dbupdate
- libpcap 1.10.7 or later for CVE-2026-31912 in other products
Immediate actions
- Run syspatch on OpenBSD 8.0 to apply errata 001-005, in particular 003_aesgmac (IPsec AES-GMAC heap overflow) on amd64 with AES-NI and octeon
- Until patched, avoid AES-GMAC in IPsec on affected hardware; AES-GCM is stated as unaffected
Workarounds
- Restrict IPsec peers to trusted addresses via PF rules
- Prefer AES-GCM over AES-GMAC for IPsec ESP
Longer-term hardening
- Upgrade to OpenBSD 8.0 for PF, bpf(4), httpd, relayd, iked and DHCP hardening
- Track OpenBSD errata page and subscribe to announce lists
CVEs associated with OpenBSD 8.0 Released With PF Firewall Hardening and Critical
CVE-2026-31912, CVE-2026-66046, CVE-2026-76641, CVE-2026-76957
Weaknesses (CWE) in OpenBSD 8.0 Released With PF Firewall Hardening and Critical
Timeline of OpenBSD 8.0 Released With PF Firewall Hardening and Critical
- CVE-2026-66046 (libexpat storeAtts quadratic complexity DoS) published in NVD
- CVE-2026-76641 (out-of-bounds read) and CVE-2026-76957 (use-after-free) published in NVD; fixed in libexpat 2.8.4
- CVE-2026-31912 (libpcap BPF interpreter bounds validation) published in NVD; fixed in libpcap 1.10.7
- Errata 001-004 published, including 003_aesgmac for the remotely triggerable IPsec AES-GMAC kernel heap overflow
- OpenBSD 8.0 released (61st release) with PF, bpf(4), httpd, relayd, iked and DHCP hardening and libexpat 2.8.4
- Errata 005 (certificate database update) published
- GBHackers reports on the release and critical errata; no exploitation or public PoC reported
Sources cited for OpenBSD 8.0 Released With PF Firewall Hardening and Critical
- OpenBSD 8.0 Released With Enhanced Firewall Security and Critical Vulnerability Fixes
- OpenBSD 8.0 release page
- OpenBSD 8.0 errata
- Errata 003 patch: IPsec AES-GMAC heap overflow
- NVD CVE-2026-31912 (libpcap BPF bounds)
- libpcap fix commit for CVE-2026-31912
- NVD CVE-2026-66046 (libexpat storeAtts quadratic complexity)
- VulnCheck: expat DoS via storeAtts quadratic complexity
- NVD CVE-2026-76641 (libexpat out-of-bounds read)
- NVD CVE-2026-76957 (libexpat use-after-free)
- libexpat PR 1322 (handler depth tracking fix)
Detection coverage for TL-2026-4490
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4490 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.