OpenBSD 7.6 is released.

Syspatch 012 (all architectures):
iked(8) and isakmpd(8) fix double-free in ecdh mode.

Syspatch 013 (all architectures):
sshd(8) fix the DisableForwarding directive, which was failing to disable X11 forwarding and agent forwarding as documented.

Syspatch 014 (all architectures):
Incorrect internal RRDP state handling in rpki-client can lead to a denial of service.

Syspatch 015 (all architectures):
In Perl, non-ASCII bytes in the left-hand-side of the `tr` operator can overflow an insufficiently sized buffer. CVE-2024-56406

Syspatch 016 (all architectures):
Kernel of NFS server could crash if nfsd(8) is enabled and an evil NFS request is sent to it.

Syspatch 017 (all architectures):
When using syncookies in pf(4), new TCP connections could run into timeout due to integer underflow.

Syspatch 018 (all architectures):
In acme-client(1), handle as yet unobserved "processing" state when fetching an issued certificate by retrying instead of giving up.

Syspatch 019 (all architectures):
Multiple X11 server issues. CVE-2025-49175 CVE-2025-49176 CVE-2025-49177 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180

Syspatch 020 (all architectures):
Previous fix for X11 server was incomplete. CVE-2025-49176

Syspatch 021 (all architectures):
TIOCUCNTL ioctl(2) could crash the kernel if called with a non-file argument.