OpenBSD MPLS bug leaks kernel stack bytes to remote attackers
A crafted MPLS packet with no Bottom-of-Stack label triggers an out-of-bounds read in OpenBSD's mpls_do_error, leaking 4 bytes of adjacent kernel stack memory in an ICMP/MPLS error response. The bug is remote, repeatable, and affects any system with MPLS enabled until the June 18, 2026 fix.