CVE-2025-14769 - ipfw denial of service

Back Back to CVE browser

HIGH

ipfw denial of service

Published Mar 9, 2026

7.5

HIGH

CVSS 3.1

EPSS 1.14%

Description

In some cases, the `tcp-setmss` handler may free the packet data and throw an error without halting the rule processing engine. A subsequent rule can then allow the traffic after the packet data is gone, resulting in a NULL pointer dereference.

Maliciously crafted packets sent from a remote host may result in a Denial of Service (DoS) if the `tcp-setmss` directive is used and a subsequent rule would allow the traffic to pass.

Affected products

Vendor FreeBSD Product FreeBSD Default
n/a
- Version
  13.5-RELEASE
  Status
  affected
  Constraints
  <p8
- Version
  14.3-RELEASE
  Status
  affected
  Constraints
  <p7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FreeBSD

n/a

Version	Status	Constraints
13.5-RELEASE	affected	<p8
14.3-RELEASE	affected	<p7

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-208405
Advisory
https://security.freebsd.org/advisories/FreeBSD-SA-25:11.ipfw.asc
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-208405		Advisory
https://security.freebsd.org/advisories/FreeBSD-SA-25:11.ipfw.asc		vendor-advisoryVendor Advisory