CVE-2023-4809: Freebsd

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

In pf packet processing with a 'scrub fragment reassemble' rule, a packet containing multiple IPv6 fragment headers would be reassembled, and then immediately processed. That is, a packet with multiple fragment extension headers would not be recognized as the correct ultimate payload. Instead a packet with multiple IPv6 fragment headers would unexpectedly be interpreted as a fragmented packet, rather than as whatever the real payload is. As a result, IPv6 fragments may bypass pf firewall rules written on the assumption all fragments have been reassembled and, as a result, be forwarded or processed by the host.

Affected products

• Freebsd Freebsd: before 12.4 (fixed in 12.4); from 13.0, before 13.2 (fixed in 13.2); version 12.4 only; version 13.2 only

Published 2023-09-06. Last modified 2026-06-17.