CVE-2026-4748 pf silently ignores certain rules
A regression in FreeBSD's pf firewall causes certain address range rules to be silently ignored, potentially leading to unexpected over- or underblocking of network traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-4748?
CVE-2026-4748 is a high-severity vulnerability in Freebsd Freebsd, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf. Ranges expressed using the address[/mask-bits] syntax were not affected.
Some keywords representing actions taken on a packet-matching rule, such as 'log', 'return tll', or 'dnpipe', may suffer from the same issue. It is unlikely that users have such configurations, as these rules would always be redundant.
Affected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking.
Which versions are affected by CVE-2026-4748?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2026-4748?
No fix has been published for CVE-2026-4748 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-4748 being exploited?
There is no known exploitation of CVE-2026-4748 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-2v62-qxwf-qh42.