Live › vulnerability › CVE-2026-115484
Go to dashboardThe iscsiuio daemon in open-iscsi miscalculates the length of DHCPv4 option data and reads past its heap buffer. A crafted DHCP response from the same network segment can crash the daemon or corrupt its network configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts that run iscsiuio with IPv4 DHCP on hardware iSCSI offload NICs (Broadcom bnx2/bnx2x, QLogic qedi), typically iSCSI-boot servers. An attacker on the same L2 segment who can spoof a DHCP reply can crash the daemon and cut storage connectivity. Software-iSCSI-only hosts, hosts without iscsiuio, or those on static IPs can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| open-iscsi | vendor | all versions through current master (a65ce4b), including 2.1.13 | – |
| iscsi-initiator-utils (Red Hat Enterprise Linux 7-10) | vendor | RHEL 7, 8, 9, 10 | – |
2.1.13 still vulnerable; Debian unfixed; Red Hat RHEL 7-10 affected, no errata)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-115484")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.