CVE-2023-35784: OpenBSD Libressl

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.

Affected products

• OpenBSD Libressl: before 3.6.3 (fixed in 3.6.3); from 3.7.0, before 3.7.3 (fixed in 3.7.3)
• OpenBSD OpenBSD: version 7.2 only; version 7.3 only

Published 2023-06-16. Last modified 2026-06-17.