CVE-2006-0905: Freebsd

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

A "programming error" in fast_ipsec in FreeBSD 4.8-RELEASE through 6.1-STABLE and NetBSD 2 through 3 does not properly update the sequence number associated with a Security Association, which allows packets to pass sequence number checks and allows remote attackers to capture IPSec packets and conduct replay attacks.

Affected products

• Freebsd Freebsd: version 4.8 only; version 4.9 only; version 4.10 only; version 4.11 only; version 5.0 only; version 5.1 only; …
• Netbsd Netbsd: version 2.0 only; version 3.0 only

Published 2006-03-23. Last modified 2026-06-16.