What is the CVSS score of CVE-2026-2261?

CVE-2026-2261 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Freebsd are affected by CVE-2026-2261?

A resource exhaustion vulnerability in blocklistd allows attackers to leak socket descriptors with each malicious report, potentially exhausting system resources and degrading service availability.

How to fix or mitigate CVE-2026-2261?

Within 24 hours: Inventory all systems running blocklistd and assess exposure; implement rate limiting on adverse event reporting endpoints. Within 7 days: Deploy network segmentation to restrict which systems can submit reports to blocklistd; monitor system resource utilization for socket descriptor exhaustion. Within 30 days: Evaluate alternative blocklist solutions or request vendor update timeline; implement additional monitoring and alerting for socket descriptor consumption.

Freebsd CVE-2026-2261

HIGH

Missing Release of Resource after Effective Lifetime (CWE-772)

2026-03-09 secteam@freebsd.org

Denial Of Service Freebsd

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Mar 09, 2026 - 13:15 nvd

HIGH 7.5

DescriptionCVE.org

Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives.

Once a certain number of leaked sockets is reached, blocklistd becomes unable to run the helper script: a child process is forked, but this child dereferences a null pointer and crashes before it is able to exec the helper. At this point, blocklistd still records adverse events but is unable to block new addresses or unblock addresses whose database entries have expired.

Once a second, much higher number of leaked sockets is reached, blocklistd becomes unable to receive new adverse event reports.

An attacker may take advantage of this by triggering a large number of adverse events from sacrificial IP addresses to effectively disable blocklistd before launching an attack.

Even in the absence of attacks or probes by would-be attackers, adverse events will occur regularly in the course of normal operations, and blocklistd will gradually run out file descriptors and become ineffective.

The accumulation of open sockets may have knock-on effects on other parts of the system, resulting in a general slowdown until blocklistd is restarted.

AnalysisAI

FreeBSD's blocklistd service leaks socket descriptors on each adverse event report, causing progressive service degradation until it can no longer block malicious IP addresses or process new reports. An attacker can exploit this by generating numerous fraudulent adverse events from disposable IP addresses to exhaust socket resources and disable the blocking mechanism before launching an actual attack. The vulnerability has a high severity rating (CVSS 7.5) and currently lacks a patch.

Technical ContextAI

This vulnerability (CWE-772: Missing Release of Resource after Effective Lifetime) Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives.

Once a second,