untrusted comment: verify with openbsd-80-base.pub
RWSMSt0erHTctewzz3LwsjBCs07Fae14gI9jOle906hbvDtgDCY4NoE6s90QLqIoI4mU8HnhI6cCmpuOMCmT/TpQhuXTwtlTVwE=

OpenBSD 8.0 errata 013, November 14, 2026:

Fix an out of bounds read that may happen during renegotiation in
TLSv1.2.  Fix TLS interoperability with peers sending more than 32
signature algorithms.

Apply by doing:
    signify -Vep /etc/signify/openbsd-80-base.pub -x 013_libressl.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install libssl:
    cd /usr/src/lib/libssl
    make obj
    make
    make install

Index: lib/libssl/s3_lib.c
===================================================================
RCS file: /cvs/src/lib/libssl/s3_lib.c,v
diff -u -p -r1.266 s3_lib.c
--- lib/libssl/s3_lib.c	22 Sep 2026 03:45:18 -0000	1.266
+++ lib/libssl/s3_lib.c	6 Nov 2026 17:12:30 -0000
@@ -2511,7 +2511,8 @@ ssl3_renegotiate_check(SSL *s)
 {
 	if (!s->s3->renegotiate)
 		return 0;
-	if (SSL_in_init(s) || s->s3->rbuf.left != 0 || s->s3->wbuf.left != 0)
+	if (SSL_in_init(s) || s->s3->rbuf.left != 0 || s->s3->wbuf.left != 0 ||
+	    s->s3->tls_wrec != NULL)
 		return 0;
 
 	s->s3->hs.state = SSL_ST_RENEGOTIATE;
Index: lib/libssl/ssl_pkt.c
===================================================================
RCS file: /cvs/src/lib/libssl/ssl_pkt.c,v
diff -u -p -r1.80 ssl_pkt.c
--- lib/libssl/ssl_pkt.c	22 Sep 2026 03:45:18 -0000	1.80
+++ lib/libssl/ssl_pkt.c	6 Nov 2026 17:12:30 -0000
@@ -486,8 +486,20 @@ do_ssl3_write(SSL *s, int type, const un
 
 	memset(&cbb, 0, sizeof(cbb));
 
-	/* Send any existing record content. */
+	/*
+	 * Send any existing record content. This must be a retry of the
+	 * write that produced the pending record, otherwise we would report
+	 * the length of the pending record as having been written from the
+	 * caller's buffer.
+	 */
 	if (s->s3->tls_wrec != NULL) {
+		if (s->s3->wpend_tot > (int)len ||
+		    (s->s3->wpend_buf != buf &&
+		    !(s->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER)) ||
+		    s->s3->wpend_type != type) {
+			SSLerror(s, SSL_R_BAD_WRITE_RETRY);
+			return -1;
+		}
 		if ((ret = tls12_record_send(s->s3->tls_wrec,
 		    tls12_legacy_wire_write_cb, s)) <= 0)
 			return -1;
@@ -528,10 +540,7 @@ do_ssl3_write(SSL *s, int type, const un
 	s->s3->tls_wrec = wrec;
 	wrec = NULL;
 
-	/*
-	 * Memorize arguments so that ssl3_write_pending can detect
-	 * bad write retries later.
-	 */
+	/* Memorize arguments so that bad write retries can be detected. */
 	s->s3->wpend_tot = len;
 	s->s3->wpend_buf = buf;
 	s->s3->wpend_type = type;
@@ -1205,7 +1214,7 @@ ssl3_send_alert(SSL *s, int level, int d
 	 * If data is still being written out, the alert will be dispatched at
 	 * some point in the future.
 	 */
-	if (s->s3->wbuf.left != 0)
+	if (s->s3->wbuf.left != 0 || s->s3->tls_wrec != NULL)
 		return -1;
 
 	return ssl3_dispatch_alert(s);
Index: lib/libssl/ssl_tlsext.c
===================================================================
RCS file: /cvs/src/lib/libssl/ssl_tlsext.c,v
diff -u -p -r1.170 ssl_tlsext.c
--- lib/libssl/ssl_tlsext.c	21 Sep 2026 23:37:20 -0000	1.170
+++ lib/libssl/ssl_tlsext.c	6 Nov 2026 17:19:54 -0000
@@ -33,7 +33,8 @@
 #include "ssl_tlsext.h"
 
 #define TLSEXT_TYPE_alpn TLSEXT_TYPE_application_layer_protocol_negotiation
-#define TLSEXT_MAX_SUPPORTED_GROUPS 64
+#define TLSEXT_MAX_SUPPORTED_GROUPS	64
+#define TLSEXT_MAX_SIGALGS		256
 
 /*
  * Supported Application-Layer Protocol Negotiation - RFC 7301
@@ -610,13 +611,23 @@ tlsext_sigalgs_client_build(SSL *s, uint
 }
 
 static int
+tlsext_sigalgs_check_length(CBS *cbs)
+{
+	if (CBS_len(cbs) % 2 != 0)
+		return 0;
+	if (CBS_len(cbs) / 2 > TLSEXT_MAX_SIGALGS)
+		return 0;
+	return 1;
+}
+
+static int
 tlsext_sigalgs_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 {
 	CBS sigalgs;
 
 	if (!CBS_get_u16_length_prefixed(cbs, &sigalgs))
 		return 0;
-	if (CBS_len(&sigalgs) % 2 != 0 || CBS_len(&sigalgs) > 64)
+	if (!tlsext_sigalgs_check_length(&sigalgs))
 		return 0;
 	if (!CBS_stow(&sigalgs, &s->s3->hs.sigalgs, &s->s3->hs.sigalgs_len))
 		return 0;
@@ -656,7 +667,7 @@ tlsext_sigalgs_client_process(SSL *s, ui
 
 	if (!CBS_get_u16_length_prefixed(cbs, &sigalgs))
 		return 0;
-	if (CBS_len(&sigalgs) % 2 != 0 || CBS_len(&sigalgs) > 64)
+	if (!tlsext_sigalgs_check_length(&sigalgs))
 		return 0;
 	if (!CBS_stow(&sigalgs, &s->s3->hs.sigalgs, &s->s3->hs.sigalgs_len))
 		return 0;