CVE-2026-4748 (GCVE-0-2026-4748)

Vulnerability from cvelistv5 – Published: 2026-04-01 06:18 – Updated: 2026-04-01 14:56
VLAI?
Title
pf silently ignores certain rules
Summary
A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf. Ranges expressed using the address[/mask-bits] syntax were not affected. Some keywords representing actions taken on a packet-matching rule, such as 'log', 'return tll', or 'dnpipe', may suffer from the same issue. It is unlikely that users have such configurations, as these rules would always be redundant. Affected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-480 - Use of Incorrect Operator
  • CWE-754 - Improper Check for Unusual or Exceptional Conditions
  • CWE-1023 - Incomplete Comparison with Missing Factors
Assigner
References
Impacted products
Vendor Product Version
FreeBSD FreeBSD Affected: 15.0-RELEASE , < p5 (release)
Affected: 14.4-RELEASE , < p1 (release)
Affected: 14.3-RELEASE , < p10 (release)
Create a notification for this product.
Date Public ?
2026-03-26 05:00
Credits
Michael Gmelin
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-4748",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T14:55:44.105033Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T14:56:02.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "pf"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p5",
              "status": "affected",
              "version": "15.0-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p1",
              "status": "affected",
              "version": "14.4-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p10",
              "status": "affected",
              "version": "14.3-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Gmelin"
        }
      ],
      "datePublic": "2026-03-26T05:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates.  Only the first of such rules is actually loaded into pf.  Ranges expressed using the address[/mask-bits] syntax were not affected.\n\nSome keywords representing actions taken on a packet-matching rule, such as \u0027log\u0027, \u0027return tll\u0027, or \u0027dnpipe\u0027, may suffer from the same issue.  It is unlikely that users have such configurations, as these rules would always be redundant.\n\nAffected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-480",
              "description": "CWE-480: Use of Incorrect Operator",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-754",
              "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-1023",
              "description": "CWE-1023: Incomplete Comparison with Missing Factors",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T06:18:52.097Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:09.pf.asc"
        }
      ],
      "title": "pf silently ignores certain rules",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2026-4748",
    "datePublished": "2026-04-01T06:18:52.097Z",
    "dateReserved": "2026-03-24T04:14:17.566Z",
    "dateUpdated": "2026-04-01T14:56:02.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-4748\",\"sourceIdentifier\":\"secteam@freebsd.org\",\"published\":\"2026-04-01T07:16:02.447\",\"lastModified\":\"2026-04-01T16:23:51.263\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates.  Only the first of such rules is actually loaded into pf.  Ranges expressed using the address[/mask-bits] syntax were not affected.\\n\\nSome keywords representing actions taken on a packet-matching rule, such as \u0027log\u0027, \u0027return tll\u0027, or \u0027dnpipe\u0027, may suffer from the same issue.  It is unlikely that users have such configurations, as these rules would always be redundant.\\n\\nAffected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"secteam@freebsd.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-480\"},{\"lang\":\"en\",\"value\":\"CWE-754\"},{\"lang\":\"en\",\"value\":\"CWE-1023\"}]}],\"references\":[{\"url\":\"https://security.freebsd.org/advisories/FreeBSD-SA-26:09.pf.asc\",\"source\":\"secteam@freebsd.org\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"datePublic\": \"2026-03-26T05:00:00.000Z\", \"title\": \"pf silently ignores certain rules\", \"references\": [{\"tags\": [\"vendor-advisory\"], \"url\": \"https://security.freebsd.org/advisories/FreeBSD-SA-26:09.pf.asc\"}], \"affected\": [{\"defaultStatus\": \"unknown\", \"modules\": [\"pf\"], \"product\": \"FreeBSD\", \"vendor\": \"FreeBSD\", \"versions\": [{\"status\": \"affected\", \"versionType\": \"release\", \"version\": \"15.0-RELEASE\", \"lessThan\": \"p5\"}, {\"status\": \"affected\", \"versionType\": \"release\", \"version\": \"14.4-RELEASE\", \"lessThan\": \"p1\"}, {\"status\": \"affected\", \"versionType\": \"release\", \"version\": \"14.3-RELEASE\", \"lessThan\": \"p10\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Michael Gmelin\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates.  Only the first of such rules is actually loaded into pf.  Ranges expressed using the address[/mask-bits] syntax were not affected.\\n\\nSome keywords representing actions taken on a packet-matching rule, such as \u0027log\u0027, \u0027return tll\u0027, or \u0027dnpipe\u0027, may suffer from the same issue.  It is unlikely that users have such configurations, as these rules would always be redundant.\\n\\nAffected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking.\"}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-480\", \"description\": \"CWE-480: Use of Incorrect Operator\", \"lang\": \"en\", \"type\": \"CWE\"}, {\"cweId\": \"CWE-754\", \"description\": \"CWE-754: Improper Check for Unusual or Exceptional Conditions\", \"lang\": \"en\", \"type\": \"CWE\"}, {\"cweId\": \"CWE-1023\", \"description\": \"CWE-1023: Incomplete Comparison with Missing Factors\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"63664ac6-956c-4cba-a5d0-f46076e16109\", \"shortName\": \"freebsd\", \"dateUpdated\": \"2026-04-01T06:18:52.097Z\"}, \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-4748\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-01T14:55:44.105033Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-01T14:54:12.959Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-4748\", \"assignerOrgId\": \"63664ac6-956c-4cba-a5d0-f46076e16109\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"freebsd\", \"dateReserved\": \"2026-03-24T04:14:17.566Z\", \"datePublished\": \"2026-04-01T06:18:52.097Z\", \"dateUpdated\": \"2026-04-01T14:56:02.208Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.