A programming error in the FreeBSD blocklistd daemon leads to an unreleased socket descriptor for each adverse event report. As the leaked sockets accumulate, the helper script first fails to execute and blocklistd can no longer block or unblock addresses. When the leak reaches a higher threshold, blocklistd stops accepting new adverse event reports. The resulting denial of service can be abused by forcing the daemon to run out of file descriptors, and it may also degrade overall system performance. Based on the description, an attacker may trigger a large number of adverse events from sacrificial IP addresses to force the leak and disable blocklistd.

The affected product is the blocklistd daemon that ships with FreeBSD. The vulnerability impacts FreeBSD 15.0 and its patch releases p1 and p2. Any system running blocklistd on these versions without applying the accompanying security update is susceptible.

The CVSS base score of 7.5 classifies the flaw as high severity, but the EPSS score is below 1%, indicating a very low probability of exploitation at this time. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Attack precedence is implicit, as an adversary can abuse the socket exhaustion by flooding blocklistd with adverse event reports. The risk of a denial of service is therefore significant if the flaw is not patched.