CVE-2026-2261
Freebsd 15.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-2261 is a high-severity Missing Release of Resource after Effective Lifetime (CWE-772) vulnerability in Freebsd Freebsd. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-2261 affects blocklistd, a FreeBSD component that manages IP blocking based on adverse events. Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a threshold of leaked sockets is reached, blocklistd forks a child process to run its helper script, but the child dereferences a null pointer and crashes before executing it, preventing the blocking or unblocking of IP addresses. At a higher threshold, blocklistd becomes unable to receive new adverse event reports.
The vulnerability enables a denial-of-service attack, as an unauthenticated remote attacker can trigger a large number of adverse events from sacrificial IP addresses to exhaust resources and disable blocklistd before launching further attacks. This aligns with its CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting network accessibility, low attack complexity, no privileges needed, and high availability impact via CWE-772 (Missing Release of Resource). Normal operations also generate adverse events that gradually degrade blocklistd's effectiveness, with leaked sockets potentially causing broader system slowdowns until restart.
The FreeBSD Security Advisory (https://security.freebsd.org/advisories/FreeBSD-SA-26:03.blocklistd.asc) provides details on patches and mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10332
Vulnerability Data
Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a certain number of leaked sockets is reached, blocklistd becomes unable to run the helper script: a child process is forked, but…
more
this child dereferences a null pointer and crashes before it is able to exec the helper. At this point, blocklistd still records adverse events but is unable to block new addresses or unblock addresses whose database entries have expired. Once a second, much higher number of leaked sockets is reached, blocklistd becomes unable to receive new adverse event reports. An attacker may take advantage of this by triggering a large number of adverse events from sacrificial IP addresses to effectively disable blocklistd before launching an attack. Even in the absence of attacks or probes by would-be attackers, adverse events will occur regularly in the course of normal operations, and blocklistd will gradually run out file descriptors and become ineffective. The accumulation of open sockets may have knock-on effects on other parts of the system, resulting in a general slowdown until blocklistd is restarted.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing resource releases through dynamic analysis or stress testing.
Requiring documented development standards and tools can mandate explicit resource-release patterns in code.
Resource-quota allocation limits the blast radius of an unreleased-resource exhaustion condition.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Lifecycle management explicitly requires handling resources through end-of-life including release.
Secure SDLC practices directly prevent missing resource-release defects during development.
Runtime monitoring may surface resource-exhaustion symptoms but does not address release logic.
Capacity monitoring can detect exhaustion caused by unreleased resources but does not prevent the root defect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicit information-deletion requirements directly address timely release of resources after use.
Secure-SDLC practices include resource-management reviews, yet the control covers the entire lifecycle, not just this weakness.
Secure-coding rules can mandate explicit resource-release patterns, but the control is broader than this single weakness.
Change-management processes may catch missing de-allocation during reviews, but the control itself does not target resource lifetime.
Configuration baselines can enforce resource limits or timeouts, indirectly reducing exposure to leaks.