CVE-2026-2261

{"id": "CVE-2026-2261", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-03-09T13:15:57.093", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:03.blocklistd.asc", "source": "secteam@freebsd.org"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "secteam@freebsd.org", "description": [{"lang": "en", "value": "CWE-772"}]}], "descriptions": [{"lang": "en", "value": "Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives.\n\nOnce a certain number of leaked sockets is reached, blocklistd becomes unable to run the helper script: a child process is forked, but this child dereferences a null pointer and crashes before it is able to exec the helper. At this point, blocklistd still records adverse events but is unable to block new addresses or unblock addresses whose database entries have expired.\n\nOnce a second, much higher number of leaked sockets is reached, blocklistd becomes unable to receive new adverse event reports.\n\nAn attacker may take advantage of this by triggering a large number of adverse events from sacrificial IP addresses to effectively disable blocklistd before launching an attack.\n\nEven in the absence of attacks or probes by would-be attackers, adverse events will occur regularly in the course of normal operations, and blocklistd will gradually run out file descriptors and become ineffective.\n\nThe accumulation of open sockets may have knock-on effects on other parts of the system, resulting in a general slowdown until blocklistd is restarted."}, {"lang": "es", "value": "Debido a un error de programaci\u00f3n, blocklistd filtra un descriptor de socket por cada informe de evento adverso que recibe.\n\nUna vez que se alcanza un cierto n\u00famero de sockets filtrados, blocklistd ya no puede ejecutar el script auxiliar: se bifurca un proceso hijo, pero este hijo desreferencia un puntero nulo y falla antes de poder ejecutar el auxiliar. En este punto, blocklistd todav\u00eda registra eventos adversos pero no puede bloquear nuevas direcciones o desbloquear direcciones cuyas entradas en la base de datos han caducado.\n\nUna vez que se alcanza un segundo n\u00famero, mucho mayor, de sockets filtrados, blocklistd ya no puede recibir nuevos informes de eventos adversos.\n\nUn atacante puede aprovechar esto al desencadenar un gran n\u00famero de eventos adversos desde direcciones IP de sacrificio para deshabilitar eficazmente blocklistd antes de lanzar un ataque.\n\nIncluso en ausencia de ataques o sondeos por parte de posibles atacantes, los eventos adversos ocurrir\u00e1n regularmente en el curso de las operaciones normales, y blocklistd se quedar\u00e1 gradualmente sin descriptores de archivo y se volver\u00e1 ineficaz.\n\nLa acumulaci\u00f3n de sockets abiertos puede tener efectos en cadena en otras partes del sistema, lo que resultar\u00e1 en una ralentizaci\u00f3n general hasta que se reinicie blocklistd."}], "lastModified": "2026-03-11T15:16:28.360", "sourceIdentifier": "secteam@freebsd.org"}