OpenBSD 8.0 Released with Major Security Hardening and Post-Quantum SSH Support
OpenBSD 8.0 ships with significant security enhancements, including kernel memory randomization, improved process isolation, and experimental post-quantum SSH signature support.
OpenBSD 8.0 has been released, bringing a suite of substantial security improvements across its core components. The project's 61st release, dated October 20, 2026, introduces enhanced kernel memory map randomization and more robust process isolation, building upon previous security hardening efforts.
The release notably includes OpenSSH 10.6, which features experimental support for the ML-DSA44-Ed25519 post-quantum SSH signature scheme. This advancement focuses on signature schemes rather than key exchange, complementing the quantum-resistant connection protection introduced in earlier OpenSSH versions. To mitigate potential side-channel leaks, the LZ77 dictionary coder has been disabled in SSH. Further hardening in OpenSSH addresses channel timeouts, rekey limits, and the enforcement of the "restrict" option in authorized_keys, enhancing control over remote access features.
Beyond SSH, OpenBSD 8.0 strengthens its network services and system utilities. The PF firewall has received fixes for out-of-bounds reads and connection counter races. Web server httpd now rejects ambiguous request framing and obsolete folded headers, while relayd has been updated to reject duplicate Content-Length headers and remove them from chunked messages, ensuring more consistent HTTP request handling.
System-level security has also been a major focus. On amd64 systems, the kernel's direct memory map is now randomized, and fixes are in place for kernel stack information leaks. The release also addresses an unprivileged kernel memory read/write vulnerability affecting the m88k 88100 data pipeline. Tighter pledge socket checks and unveil restrictions for manual-page tools further limit potential attack surfaces.
LibreSSL 4.4.0, the release's cryptographic library, now prefers X25519MLKEM768 as the default TLS 1.3 group in libtls. It also includes fixes for certificate checks, an OCSP responder authorization bypass, and excessive DTLS handshake buffering, contributing to more secure encrypted communications.
Security in the update and package management process has been improved. Firmware updates now verify signatures on local SHA256.sig files and restrict download sizes. Package installation no longer defaults to searching the current directory, and the pax utility is enhanced to prevent malicious archives from extracting files outside the intended working directory.
Administrators are advised to review the detailed release notes and errata for compatibility changes and to consult upgrade documentation before deploying OpenBSD 8.0 to production environments. The comprehensive security enhancements underscore OpenBSD's continued commitment to providing a highly secure operating system.