CVE-2026-2261

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2261", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "state": "PUBLISHED", "assignerShortName": "freebsd", "dateReserved": "2026-02-09T17:48:49.244Z", "datePublished": "2026-03-09T12:10:08.194Z", "dateUpdated": "2026-03-11T15:02:53.159Z"}, "containers": {"cna": {"datePublic": "2026-02-10T19:00:00.000Z", "title": "blocklistd(8) socket leak", "references": [{"tags": ["vendor-advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:03.blocklistd.asc"}], "affected": [{"defaultStatus": "unknown", "modules": ["blocklistd"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"lessThan": "p3", "status": "affected", "version": "15.0-RELEASE", "versionType": "release"}]}], "descriptions": [{"lang": "en", "value": "Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives.\n\nOnce a certain number of leaked sockets is reached, blocklistd becomes unable to run the helper script: a child process is forked, but this child dereferences a null pointer and crashes before it is able to exec the helper. At this point, blocklistd still records adverse events but is unable to block new addresses or unblock addresses whose database entries have expired.\n\nOnce a second, much higher number of leaked sockets is reached, blocklistd becomes unable to receive new adverse event reports.\n\nAn attacker may take advantage of this by triggering a large number of adverse events from sacrificial IP addresses to effectively disable blocklistd before launching an attack.\n\nEven in the absence of attacks or probes by would-be attackers, adverse events will occur regularly in the course of normal operations, and blocklistd will gradually run out file descriptors and become ineffective.\n\nThe accumulation of open sockets may have knock-on effects on other parts of the system, resulting in a general slowdown until blocklistd is restarted."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-772", "description": "CWE-772: Missing Release of Resource after Effective Lifetime", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-03-09T12:10:08.194Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T15:02:47.286466Z", "id": "CVE-2026-2261", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:02:53.159Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-2261", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T15:02:47.286466Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:02:33.155Z"}}], "cna": {"title": "blocklistd(8) socket leak", "affected": [{"vendor": "FreeBSD", "modules": ["blocklistd"], "product": "FreeBSD", "versions": [{"status": "affected", "version": "15.0-RELEASE", "lessThan": "p3", "versionType": "release"}], "defaultStatus": "unknown"}], "datePublic": "2026-02-10T19:00:00.000Z", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:03.blocklistd.asc", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives.\n\nOnce a certain number of leaked sockets is reached, blocklistd becomes unable to run the helper script: a child process is forked, but this child dereferences a null pointer and crashes before it is able to exec the helper. At this point, blocklistd still records adverse events but is unable to block new addresses or unblock addresses whose database entries have expired.\n\nOnce a second, much higher number of leaked sockets is reached, blocklistd becomes unable to receive new adverse event reports.\n\nAn attacker may take advantage of this by triggering a large number of adverse events from sacrificial IP addresses to effectively disable blocklistd before launching an attack.\n\nEven in the absence of attacks or probes by would-be attackers, adverse events will occur regularly in the course of normal operations, and blocklistd will gradually run out file descriptors and become ineffective.\n\nThe accumulation of open sockets may have knock-on effects on other parts of the system, resulting in a general slowdown until blocklistd is restarted."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-772", "description": "CWE-772: Missing Release of Resource after Effective Lifetime"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-03-09T12:10:08.194Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2261", "state": "PUBLISHED", "dateUpdated": "2026-03-11T15:02:53.159Z", "dateReserved": "2026-02-09T17:48:49.244Z", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "datePublished": "2026-03-09T12:10:08.194Z", "assignerShortName": "freebsd"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["blocklistd"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"lessThan": "p3", "status": "affected", "version": "15.0-RELEASE", "versionType": "release"}]}], "source": "secteam@freebsd.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*", "matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*", "matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*", "matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives.\n\nOnce a certain number of leaked sockets is reached, blocklistd becomes unable to run the helper script: a child process is forked, but this child dereferences a null pointer and crashes before it is able to exec the helper. At this point, blocklistd still records adverse events but is unable to block new addresses or unblock addresses whose database entries have expired.\n\nOnce a second, much higher number of leaked sockets is reached, blocklistd becomes unable to receive new adverse event reports.\n\nAn attacker may take advantage of this by triggering a large number of adverse events from sacrificial IP addresses to effectively disable blocklistd before launching an attack.\n\nEven in the absence of attacks or probes by would-be attackers, adverse events will occur regularly in the course of normal operations, and blocklistd will gradually run out file descriptors and become ineffective.\n\nThe accumulation of open sockets may have knock-on effects on other parts of the system, resulting in a general slowdown until blocklistd is restarted."}, {"lang": "es", "value": "Debido a un error de programaci\u00f3n, blocklistd filtra un descriptor de socket por cada informe de evento adverso que recibe.\n\nUna vez que se alcanza un cierto n\u00famero de sockets filtrados, blocklistd ya no puede ejecutar el script auxiliar: se bifurca un proceso hijo, pero este hijo desreferencia un puntero nulo y falla antes de poder ejecutar el auxiliar. En este punto, blocklistd todav\u00eda registra eventos adversos pero no puede bloquear nuevas direcciones o desbloquear direcciones cuyas entradas en la base de datos han caducado.\n\nUna vez que se alcanza un segundo n\u00famero, mucho mayor, de sockets filtrados, blocklistd ya no puede recibir nuevos informes de eventos adversos.\n\nUn atacante puede aprovechar esto al desencadenar un gran n\u00famero de eventos adversos desde direcciones IP de sacrificio para deshabilitar eficazmente blocklistd antes de lanzar un ataque.\n\nIncluso en ausencia de ataques o sondeos por parte de posibles atacantes, los eventos adversos ocurrir\u00e1n regularmente en el curso de las operaciones normales, y blocklistd se quedar\u00e1 gradualmente sin descriptores de archivo y se volver\u00e1 ineficaz.\n\nLa acumulaci\u00f3n de sockets abiertos puede tener efectos en cadena en otras partes del sistema, lo que resultar\u00e1 en una ralentizaci\u00f3n general hasta que se reinicie blocklistd."}], "id": "CVE-2026-2261", "lastModified": "2026-06-17T10:30:39.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2261", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T15:02:47.286466Z", "version": "2.0.3"}}]}, "published": "2026-03-09T13:15:57.093", "references": [{"source": "secteam@freebsd.org", "tags": ["Vendor Advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:03.blocklistd.asc"}], "sourceIdentifier": "secteam@freebsd.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-772"}], "source": "secteam@freebsd.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.0-RELEASE,p3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FreeBSD", "source": "cna", "vendor": "FreeBSD"}, "product": "freebsd", "vendor": "freebsd"}], "analysis": {"en": {"generated_at": "2026-04-16T04:00:17.133003+00:00", "value": {"mitigation_remediation": ["Upgrade FreeBSD to the latest patch that contains the blocklistd socket close fix, as documented in the FreeBSD security advisory.", "Restart the blocklistd daemon after applying the update to clear any existing leaked sockets.", "Implement monitoring of blocklistd\u2019s file descriptor usage and set alerts if the count approaches the system\u2019s limit.", "As a temporary workaround, consider reducing the frequency of adverse event reports or temporarily disabling blocklistd until the update is applied."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected product is the blocklistd daemon that ships with FreeBSD. The vulnerability impacts FreeBSD 15.0 and its patch releases p1 and p2. Any system running blocklistd on these versions without applying the accompanying security update is susceptible.", "description_and_impact": "A programming error in the FreeBSD blocklistd daemon leads to an unreleased socket descriptor for each adverse event report. As the leaked sockets accumulate, the helper script first fails to execute and blocklistd can no longer block or unblock addresses. When the leak reaches a higher threshold, blocklistd stops accepting new adverse event reports. The resulting denial of service can be abused by forcing the daemon to run out of file descriptors, and it may also degrade overall system performance. Based on the description, an attacker may trigger a large number of adverse events from sacrificial IP addresses to force the leak and disable blocklistd.", "risk_and_exploitability": "The CVSS base score of 7.5 classifies the flaw as high severity, but the EPSS score is below 1%, indicating a very low probability of exploitation at this time. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Attack precedence is implicit, as an adversary can abuse the socket exhaustion by flooding blocklistd with adverse event reports. The risk of a denial of service is therefore significant if the flaw is not patched."}}}}, "created": "2026-03-10T14:07:25.959081+00:00", "updated": "2026-04-16T04:15:24.070502+00:00", "vendors": ["freebsd", "freebsd$PRODUCT$freebsd"]}