OpenBSD TCP SACK 27-Year Bug

Description

Denial-of-service vulnerability in OpenBSD's TCP SACK implementation present since 1999 (27 years). Autonomously discovered by Claude Mythos Preview across ~1,000 scaffold runs at total compute cost under $20,000. Allows remote attacker to crash any OpenBSD host responding over TCP. Patched in OpenBSD 7.8 Errata #025 on March 25, 2026 - six days before the npm source leak.

Key claims

Relations

Sources

src-20260409-28c9af66ed0c