What is the CVSS score of CVE-2026-4748?

CVE-2026-4748 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Freebsd CVE-2026-4748

EUVD-2026-17818 HIGH

Use of Incorrect Operator (CWE-480)

2026-04-01 freebsd

GHSA-2v62-qxwf-qh42

Information Disclosure Freebsd

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 07:00 euvd

EUVD-2026-17818

Analysis Generated

Apr 01, 2026 - 07:00 vuln.today

CVE Published

Apr 01, 2026 - 06:18 nvd

HIGH 7.5

DescriptionCVE.org

A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf. Ranges expressed using the address[/mask-bits] syntax were not affected.

Some keywords representing actions taken on a packet-matching rule, such as 'log', 'return tll', or 'dnpipe', may suffer from the same issue. It is unlikely that users have such configurations, as these rules would always be redundant.

Affected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking.

AnalysisAI

Packet filter (pf) rule hash calculation regression in FreeBSD causes rules with address range syntax (x.x.x.x - y.y.y.y) differing only in address ranges to be silently dropped as duplicates, loading only the first rule and potentially causing unexpected packet filtering behavior including unintended blocking or allowing of traffic. The regression affects pf's duplicate detection mechanism but does not impact rules using CIDR notation (address/mask-bits syntax). Only the first of multiple such rules is loaded, creating a silent configuration failure with no warning to administrators.

Technical ContextAI

This vulnerability affects FreeBSD's packet filter (pf), a stateful firewall implementation that uses rule hashing to detect and eliminate duplicate configurations. The regression occurred in the hash calculation function that processes pf ruleset definitions. CWE-480 (Use of Incorrect Operator) indicates that an incorrect comparison or mathematical operation was introduced during recent changes, causing rules with semantically different address ranges (e.g., '192.168.1.1 - 192.168.1.100' vs '192.168.1.100 - 192.168.1.200') to produce identical hash values. This collision mechanism causes the duplicate detection logic to incorrectly classify distinct rules as identical. The impact is confined to rules using the range syntax; CIDR notation rules (address/mask-bits) hash correctly and are unaffected, suggesting the regression is specific to how the range operator parses or hashes the start and end addresses.

RemediationAI

Apply the patch provided in FreeBSD Security Advisory FreeBSD-SA-26:09.pf via the FreeBSD Update utility (freebsd-update fetch install) or by rebuilding the kernel with the patched pf code. Immediately following patch installation, reload pf rules using 'pfctl -f /etc/pf.conf' and verify that the expected number of rules are loaded (compare 'pfctl -s rules' output against configuration intent). As a temporary mitigation pending patch deployment, convert any address range rules (x.x.x.x - y.y.y.y syntax) to equivalent CIDR notation (address/mask-bits), which are unaffected by the regression, or explicitly verify all intended rules are active via 'pfctl -s rules'. Audit pf configurations for unintentional redundancy in action keywords ('log', 'return ttl', 'dnpipe') which may also be affected.