What is the CVSS score of CVE-2026-4247?

CVE-2026-4247 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Freebsd are affected by CVE-2026-4247?

Organizations using When a challenge ACK face notable risk from CVE-2026-4247 rated CVSS 7.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-4247?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Freebsd CVE-2026-4247

EUVD-2026-16128 HIGH

Memory Leak (CWE-401)

2026-03-26 freebsd

Information Disclosure Freebsd

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 06:30 euvd

EUVD-2026-16128

Analysis Generated

Mar 26, 2026 - 06:30 vuln.today

CVE Published

Mar 26, 2026 - 06:09 nvd

HIGH 7.5

DescriptionCVE.org

When a challenge ACK is to be sent tcp_respond() constructs and sends the challenge ACK and consumes the mbuf that is passed in. When no challenge ACK should be sent the function returns and leaks the mbuf.

If an attacker is either on path with an established TCP connection, or can themselves establish a TCP connection, to an affected FreeBSD machine, they can easily craft and send packets which meet the challenge ACK criteria and cause the FreeBSD host to leak an mbuf for each crafted packet in excess of the configured rate limit settings i.e. with default settings, crafted packets in excess of the first 5 sent within a 1s period will leak an mbuf.

Technically, off-path attackers can also exploit this problem by guessing the IP addresses, TCP port numbers and in some cases the sequence numbers of established connections and spoofing packets towards a FreeBSD machine, but this is harder to do effectively.

AnalysisAI

This vulnerability is a memory leak in FreeBSD's TCP stack where the tcp_respond() function fails to properly free allocated memory buffers (mbufs) when challenge ACKs are not sent in response to crafted packets. FreeBSD systems of all versions are affected. An attacker with network access (either on-path with an established connection or able to establish one, or via spoofed packets) can trigger this leak repeatedly by sending specially crafted packets that exceed rate limits, causing heap exhaustion and potential denial of service through resource depletion.

Technical ContextAI

This vulnerability exists in the FreeBSD kernel's TCP/IP network stack, specifically in the tcp_respond() function which handles challenge ACK generation. Challenge ACKs are legitimate TCP responses used to verify connection state in edge cases. The root cause is classified under CWE-401 (Missing Release of Memory after Effective Lifetime), a classic resource management flaw. When the function constructs a challenge ACK, it properly consumes the input mbuf (kernel memory buffer). However, when the function determines that no challenge ACK should be sent (due to rate limiting or other conditions), it returns without deallocating the mbuf, causing a memory leak. Each leak is small, but repeated exploitation exhausts kernel memory resources. The affected product is FreeBSD across all versions (cpe:2.3:a:freebsd:freebsd:*:*:*:*:*:*:*:*), indicating this is a long-standing issue in the core TCP implementation.

RemediationAI

Apply the security patch provided by FreeBSD in advisory FreeBSD-SA-26:06.tcp.asc immediately (https://security.freebsd.org/advisories/FreeBSD-SA-26:06.tcp.asc). The patch corrects the tcp_respond() function to properly deallocate mbufs in all code paths. For systems unable to patch immediately, network-level mitigation can be implemented by restricting TCP traffic from untrusted sources using firewalls or access control lists, though this does not eliminate the vulnerability for on-path or spoofed traffic scenarios. Additionally, increasing kernel memory buffers and monitoring for signs of memory exhaustion (e.g., mbuf pool depletion warnings in system logs) can provide temporary resilience but should not be relied upon as a permanent workaround. Prioritize patching over compensating controls.