Log in Start free

Vulnerability · Published Apr 1, 2026 · Assigned by freebsd

CVE-2026-4748pf silently ignores certain rules

High 7.5

In plain English

A high-severity security flaw in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 82.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf. Ranges expressed using the address[/mask-bits] syntax were not affected. Some keywords representing actions taken on a packet-matching rule, such as 'log', 'return tll', or 'dnpipe', may suffer from the same issue. It is unlikely that users have such configurations, as these rules would always be redundant. Affected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking.

Affected products (as reported)

VendorProductVersions
FreeBSD FreeBSD 15.0-RELEASE – before p514.4-RELEASE – before p114.3-RELEASE – before p10

Weakness: CWE-480, CWE-754, CWE-1023 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References