CVE-2026-18726
published 2026-08-12CVE-2026-18726: A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the…
PriorityP427medium6.5CVSS 3.1
AVAACLPRNUINSUCNINAH
EPSS
0.21%
9.9th percentile
A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
open-iscsi: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing
vendor_redhat·2026-08-12·CVSS 6.5
CVE-2026-18726 [MEDIUM] CWE-835 open-iscsi: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing
open-iscsi: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing
A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.
A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial
GHSA
A flaw was found in open-iscsi.
ghsa_unreviewed·2026-08-13
CVE-2026-18726 [MEDIUM] CWE-835 A flaw was found in open-iscsi.
A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-18726 iscsi-initiator-utils: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing [fedora-all]
bugzilla·2026-08-12·CVSS 6.5
CVE-2026-18726 [MEDIUM] CVE-2026-18726 iscsi-initiator-utils: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing [fedora-all]
CVE-2026-18726 iscsi-initiator-utils: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10
Summary: Infinite Loop in ICMPv6 Router Advertisement Parsing: a crafted
on-link ICMPv6 Router Advertisement with a zero-length option can hang
`iscsiuio` in a non-terminating parse loop, and a short IPv6 payload can
also underflow the option length and drive out-of-bounds reads.
Requirements to exploit: An attacker must be able to send ICMPv6 Router
Advertisements from the sa
Bugzilla
CVE-2026-18726 iscsi-initiator-utils: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing [fedora-all]
bugzilla·2026-08-12·CVSS 6.5
CVE-2026-18726 [MEDIUM] CVE-2026-18726 iscsi-initiator-utils: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing [fedora-all]
CVE-2026-18726 iscsi-initiator-utils: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10
Summary: Infinite Loop in ICMPv6 Router Advertisement Parsing: a crafted
on-link ICMPv6 Router Advertisement with a zero-length option can hang
`iscsiuio` in a non-terminating parse loop, and a short IPv6 payload can
also underflow the option length and drive out-of-bounds reads.
Requirements to exploit: An attacker must be able to send ICMPv6 Router
Advertisements from the sa
Bugzilla
CVE-2026-18726 open-iscsi: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing
bugzilla·2026-04-26·CVSS 6.5
CVE-2026-18726 [MEDIUM] CVE-2026-18726 open-iscsi: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing
CVE-2026-18726 open-iscsi: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing
AI_ONLY_REPORT
package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10
Summary: Infinite Loop in ICMPv6 Router Advertisement Parsing: a crafted
on-link ICMPv6 Router Advertisement with a zero-length option can hang
`iscsiuio` in a non-terminating parse loop, and a short IPv6 payload can
also underflow the option length and drive out-of-bounds reads.
Requirements to exploit: An attacker must be able to send ICMPv6 Router
Advertisements from the same L2 segment to an IPv6-enabled interface
handled by `iscsiuio`. In the observed code, repeated exploitation may
depend on the current IPv6 context because the handler returns early once
`IPV6_FLAGS_ROUTER_ADV_RECEIVED` is set.
Component affected:
2026-08-12
Published