DEBIAN-CVE-2026-115484: High severity debian/open-iscsi vulnerability

Published Oct 23, 2026

Updated

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.

Affected Software

3 affected components

debian/open-iscsi*

Event History

Oct 23, 2026

CVE Published

via OSV·01:16 AM

Data Sourced

via OSV·01:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What attacker position is required to exploit this issue?

An attacker must be on the same network segment as the affected iscsiuio daemon and able to send it a crafted DHCP response. No privileges or user interaction are required.

What could exploitation do to an affected system?

Exploitation can crash the daemon or corrupt its network configuration. The reported impact includes limited confidentiality and integrity effects, with high availability impact.

DEBIAN-CVE-2026-115484: High severity debian/open-iscsi vulnerability

Affected Software

Event History

Frequently Asked Questions

What attacker position is required to exploit this issue?

What could exploitation do to an affected system?

Company

Resources

Contact

Frequently Asked Questions

What attacker position is required to exploit this issue?

What could exploitation do to an affected system?