Freebsd CVE-2026-4748

OpenBSD pf firewall with rules using address range syntax (x.x.x.x - y.y.y.y) where multiple rules differ only in ranges. Attacker must craft network traffic to match ranges intended by dropped duplicate rules. No authentication required; remote network access sufficient.

This vulnerability presents moderate real-world risk despite the absence of a CVSS score. The technical impact is high-silent rule suppression can cause significant firewall policy violations, with potential for both over-blocking (legitimate traffic denied) and underblocking (malicious traffic allowed). However, the attack surface is administrative/configuration-based rather than remotely exploitable; an attacker cannot directly trigger the vulnerability but relies on administrators deploying vulnerable pf configurations. Exploitation requires no authentication or network access; it is purely a logic flaw in rule processing. The SSVC decision framework suggests this warrants urgent attention: technical impact is high (integrity of packet filtering), the mechanism is deterministic and reliable (high confidence in triggering), but exploitability depends on configuration choices. Organizations using pf with address range syntax rules are at direct risk; those using only CIDR notation are unaffected. The regression status (this is a reintroduced bug, not a new design flaw) suggests it may be relatively recent and could be widespread in affected FreeBSD versions.

A FreeBSD system administrator configures a pf firewall with multiple rules using address ranges to block traffic from different subnets: 'block in quick from 192.168.1.1 - 192.168.1.100' and 'block in quick from 192.168.1.100 - 192.168.1.200'. Due to the hash regression, the second rule is silently dropped as a duplicate. An attacker spoofing addresses in the range 192.168.1.100 - 192.168.1.200 successfully penetrates the firewall because only the first rule is active, causing unexpected underblocking. Alternatively, an administrator intends to allow specific traffic via a rule with ranges that gets dropped, resulting in legitimate users being denied access (overblocking). The attack is passive; the regression is triggered automatically during pf ruleset loading, requiring no active exploitation technique.