Read the docs
TI-2026-04143 Aliases CVE-2026-4748GHSA-2v62-qxwf-qh42

pf silently ignores certain rules

Priority LOW 38CWE-1023Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf. Ranges expressed using the address[/mask-bits] syntax were not affected. Some keywords representing actions taken on a packet-matching rule, such as 'log', 'return tll', or 'dnpipe', may suffer from the same issue. It is unlikely that users have such configurations, as these rules would always be redundant. Affected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00254 17th percentileScored 2026-11-07
Fix Fixed FreeBSD (FreeBSD): p5, p1, p10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FreeBSDFreeBSD15.0-RELEASE to before p5; 14.4-RELEASE to before p1; 14.3-RELEASE to before p10p5, p1, p10Patch availableCNA
  • FreeBSD VendorFreeBSD Affected 15.0-RELEASE to before p5; 14.4-RELEASE to before p1; 14.3-RELEASE to before p10 Fixed in p5, p1, p10 Patch available CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*14.0 to before 14.4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*14.3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*14.3 p1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*14.3 p2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*14.3 p3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*14.3 p4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*14.3 p5VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*14.3 p6VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*14.3 p7VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*14.3 p8VulnerableFreeBSD
  • cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* Versions 14.0 to before 14.4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:* Versions 14.3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:* Versions 14.3 p1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:* Versions 14.3 p2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:* Versions 14.3 p3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:* Versions 14.3 p4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:* Versions 14.3 p5 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:* Versions 14.3 p6 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:* Versions 14.3 p7 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:* Versions 14.3 p8 Vulnerable ·FreeBSD
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*14.3 p9VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*14.4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*14.4 rc1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*15.0VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*15.0 p1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*15.0 p2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*15.0 p3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*15.0 p4VulnerableFreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:* Versions 14.3 p9 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:* Versions 14.4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:* Versions 14.4 rc1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:* Versions 15.0 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* Versions 15.0 p1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* Versions 15.0 p2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* Versions 15.0 p3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* Versions 15.0 p4 Vulnerable ·FreeBSD

Remediation

  • Fix · CNA FreeBSD (FreeBSD) Fixed in p5, p1, p10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4748
  2. 2026-10-03 Alias added: GHSA-2v62-qxwf-qh42

References

Advisory 1

  • TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
  • TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
  • TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
  • TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
See all 576 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences