Cyber Posture

CVE-2026-2261

High

Published: 09 March 2026

Published
09 March 2026
Modified
17 March 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0002 5.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2261 is a high-severity Missing Release of Resource after Effective Lifetime (CWE-772) vulnerability in Freebsd Freebsd. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Service Exhaustion Flood (T1499.002); ranked at the 5.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Service Exhaustion Flood (T1499.002) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-772

Ensures network resources are released once the session ends or becomes inactive, closing the window for missing-release weaknesses.

MITRE ATT&CK Enterprise TechniquesAI

T1499.002 Service Exhaustion Flood Impact
Adversaries may target the different network services provided by systems to conduct a denial of service (DoS).
T1562.001 Disable or Modify Tools Stealth
Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.
Why these techniques?

Resource exhaustion via adverse event flooding directly enables service exhaustion DoS (T1499.002) and disables the blocklistd security tool (T1562.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a certain number of leaked sockets is reached, blocklistd becomes unable to run the helper script: a child process is forked, but…

more

this child dereferences a null pointer and crashes before it is able to exec the helper. At this point, blocklistd still records adverse events but is unable to block new addresses or unblock addresses whose database entries have expired. Once a second, much higher number of leaked sockets is reached, blocklistd becomes unable to receive new adverse event reports. An attacker may take advantage of this by triggering a large number of adverse events from sacrificial IP addresses to effectively disable blocklistd before launching an attack. Even in the absence of attacks or probes by would-be attackers, adverse events will occur regularly in the course of normal operations, and blocklistd will gradually run out file descriptors and become ineffective. The accumulation of open sockets may have knock-on effects on other parts of the system, resulting in a general slowdown until blocklistd is restarted.

Deeper analysisAI

CVE-2026-2261 affects blocklistd, a FreeBSD component that manages IP blocking based on adverse events. Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a threshold of leaked sockets is reached, blocklistd forks a child process to run its helper script, but the child dereferences a null pointer and crashes before executing it, preventing the blocking or unblocking of IP addresses. At a higher threshold, blocklistd becomes unable to receive new adverse event reports.

The vulnerability enables a denial-of-service attack, as an unauthenticated remote attacker can trigger a large number of adverse events from sacrificial IP addresses to exhaust resources and disable blocklistd before launching further attacks. This aligns with its CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting network accessibility, low attack complexity, no privileges needed, and high availability impact via CWE-772 (Missing Release of Resource). Normal operations also generate adverse events that gradually degrade blocklistd's effectiveness, with leaked sockets potentially causing broader system slowdowns until restart.

The FreeBSD Security Advisory (https://security.freebsd.org/advisories/FreeBSD-SA-26:03.blocklistd.asc) provides details on patches and mitigation steps.

Details

CWE(s)

Affected Products

freebsd
freebsd
15.0

CVEs Like This One

CVE-2026-4652Same product: Freebsd Freebsd
CVE-2025-15576Same product: Freebsd Freebsd
CVE-2026-39457Same product: Freebsd Freebsd
CVE-2026-4247Same product: Freebsd Freebsd
CVE-2026-4748Same product: Freebsd Freebsd
CVE-2026-3038Same product: Freebsd Freebsd
CVE-2026-42511Same product: Freebsd Freebsd
CVE-2026-42512Same product: Freebsd Freebsd
CVE-2025-14558Same product: Freebsd Freebsd
CVE-2026-7164Same product: Freebsd Freebsd

References