untrusted comment: verify with openbsd-79-base.pub
RWTSdNN9A3yvWH8HA453MqkXwNi4F9cD6QRrxGFHKkm4ajqgo8BtjmZQG+mmSwzFk91rMW2C7NwoWxbm4oLV6oMv2fTGhZG8fgw=

OpenBSD 7.9 errata 048, November 14, 2026:

Fix TLS interoperability with peers sending more than 32 signature
algorithms.

Apply by doing:
    signify -Vep /etc/signify/openbsd-79-base.pub -x 048_libressl.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install libssl:
    cd /usr/src/lib/libssl
    make obj
    make
    make install

Index: lib/libssl/ssl_tlsext.c
===================================================================
RCS file: /cvs/src/lib/libssl/ssl_tlsext.c,v
diff -u -p -r1.159 ssl_tlsext.c
--- lib/libssl/ssl_tlsext.c	4 Dec 2025 21:16:17 -0000	1.159
+++ lib/libssl/ssl_tlsext.c	6 Nov 2026 17:30:15 -0000
@@ -33,7 +33,8 @@
 #include "ssl_tlsext.h"
 
 #define TLSEXT_TYPE_alpn TLSEXT_TYPE_application_layer_protocol_negotiation
-#define TLSEXT_MAX_SUPPORTED_GROUPS 64
+#define TLSEXT_MAX_SUPPORTED_GROUPS	64
+#define TLSEXT_MAX_SIGALGS		256
 
 /*
  * Supported Application-Layer Protocol Negotiation - RFC 7301
@@ -594,13 +595,23 @@ tlsext_sigalgs_client_build(SSL *s, uint
 }
 
 static int
+tlsext_sigalgs_check_length(CBS *cbs)
+{
+	if (CBS_len(cbs) % 2 != 0)
+		return 0;
+	if (CBS_len(cbs) / 2 > TLSEXT_MAX_SIGALGS)
+		return 0;
+	return 1;
+}
+
+static int
 tlsext_sigalgs_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 {
 	CBS sigalgs;
 
 	if (!CBS_get_u16_length_prefixed(cbs, &sigalgs))
 		return 0;
-	if (CBS_len(&sigalgs) % 2 != 0 || CBS_len(&sigalgs) > 64)
+	if (!tlsext_sigalgs_check_length(&sigalgs))
 		return 0;
 	if (!CBS_stow(&sigalgs, &s->s3->hs.sigalgs, &s->s3->hs.sigalgs_len))
 		return 0;
@@ -640,7 +651,7 @@ tlsext_sigalgs_client_process(SSL *s, ui
 
 	if (!CBS_get_u16_length_prefixed(cbs, &sigalgs))
 		return 0;
-	if (CBS_len(&sigalgs) % 2 != 0 || CBS_len(&sigalgs) > 64)
+	if (!tlsext_sigalgs_check_length(&sigalgs))
 		return 0;
 	if (!CBS_stow(&sigalgs, &s->s3->hs.sigalgs, &s->s3->hs.sigalgs_len))
 		return 0;