pfSense CE 2.9.0: supported remediation for four pkg audit findings

[image101llc]

Hello Netgate team,

On pfSense CE 2.9.0-RELEASE amd64, pkg audit reports nine advisory entries across four installed packages:

• openvpn 2.7.5: CVE-2026-84732
• giflib 5.2.2: CVE-2026-26740
• python311 3.11.15_3: CVE-2026-1502, CVE-2026-4786, CVE-2025-15367, CVE-2026-6100, CVE-2025-15366, and the configparser excessive-CPU advisory
• rsync 3.4.4: the 33-issue VuXML advisory fee67ad5-a05e-11f1-ad2b-40b034429ecf

Checks on September 11, 2026:

• Both official pfSense 2.9.0 repositories refresh successfully; pkg upgrade -n reports zero candidates.
• pfSense-upgrade -c reports the system is up to date.
• No packages are locked. FreeBSD repositories are disabled.
• Installed System_Patches 2.3.4 contains no recommended entries targeting 2.9.0.
• No OpenVPN servers or clients are configured, and no OpenVPN process is running.
• rsyncd_enable is NO and rsyncd is not running. No literal rsync entries appear in config.xml.
• Python is a dependency of Unbound, Suricata, and pfBlockerNG. rsync is required by pfBlockerNG. OpenVPN is required by pfSense-system. giflib is required by webp, which is required by libgd/graphviz.

Are these findings addressed by backports not represented by the package versions, or is an official updated package/release planned? Please provide the supported remediation or interim mitigation for each package, including any relevant patch/issue references. We want to preserve DNS, filtering, and IDS functionality and have not forced upgrades from FreeBSD repositories or removed dependencies.

Thank you.

[KOM]

@image101llc None of those really affected anything other than the OpenVPN bug, and that is mitigated by using a tls key. iirc that's the default setting.