A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf. Ranges expressed using the address[/mask-bits] syntax were not affected.
Some keywords representing actions taken on a packet-matching rule, such as 'log', 'return tll', or 'dnpipe', may suffer from the same issue. It is unlikely that users have such configurations, as these rules would always be redundant.
Affected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Freebsd |
|
Configuration 1 [-]
|
No data.
References
History
Thu, 02 Apr 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* |
Thu, 02 Apr 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Freebsd
Freebsd freebsd |
|
| Vendors & Products |
Freebsd
Freebsd freebsd |
Wed, 01 Apr 2026 23:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 01 Apr 2026 07:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf. Ranges expressed using the address[/mask-bits] syntax were not affected. Some keywords representing actions taken on a packet-matching rule, such as 'log', 'return tll', or 'dnpipe', may suffer from the same issue. It is unlikely that users have such configurations, as these rules would always be redundant. Affected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking. | |
| Title | pf silently ignores certain rules | |
| Weaknesses | CWE-1023 CWE-480 CWE-754 |
|
| References |
|
MITRE
Status: PUBLISHED
Assigner: freebsd
Published:
Updated: 2026-04-01T14:56:02.208Z
Reserved: 2026-03-24T04:14:17.566Z
Link: CVE-2026-4748
Vulnrichment
Updated: 2026-04-01T14:54:12.959Z
NVD
Status : Analyzed
Published: 2026-04-01T07:16:02.447
Modified: 2026-04-02T20:47:20.810
Link: CVE-2026-4748
Redhat
No data.