CVE-2021-46880: OpenBSD Libressl

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes discarded.

Affected products

• OpenBSD Libressl: before 3.4.2 (fixed in 3.4.2)
• OpenBSD OpenBSD: before 7.0 (fixed in 7.0)

Published 2023-04-15. Last modified 2026-06-17.