PT-2026-24060 · Unknown · Blocklistd

Published 2026-03-09 · Updated 2026-03-09 · CVE-2026-2261

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions blocklistd (affected versions not specified)

Description A programming error in blocklistd causes it to leak a socket descriptor for each adverse event report it receives. As the number of leaked sockets increases, blocklistd becomes unable to run its helper script due to a null pointer dereference, leading to a crash. This prevents blocklistd from blocking or unblocking addresses. Eventually, blocklistd becomes unable to receive new adverse event reports. An attacker can exploit this by triggering a large number of adverse events from multiple IP addresses to disable blocklistd before launching an attack. Even without malicious activity, normal operations can lead to the accumulation of open sockets, causing blocklistd to become ineffective and potentially slowing down the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2026-2261

Affected Products

Blocklistd

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-2261 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-26:03.blocklistd.asc · Vendor Advisory
• https://twitter.com/cyberbivash/status/2031058599800176877 · Twitter Post
• https://t.me/CVEtracker/46903 · Telegram Post
• https://twitter.com/CVEnew/status/2031122535090205158 · Twitter Post