{"id":"CVE-2026-115484","kind":"vulnerability","aliases":["CVE-2026-115484"],"related":[],"title":"open-iscsi iscsiuio: DHCP option parsing over-reads heap, crashes daemon","description":"A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.","summary":"The iscsiuio daemon in open-iscsi miscalculates the length of DHCPv4 option data and reads past its heap buffer. A crafted DHCP response from the same network segment can crash the daemon or corrupt its network configuration.","severity":"high","cvss":7.6,"epss":0.00221,"exploited":false,"exploited_at":null,"products":[{"name":"open-iscsi","fixed":[],"affected":"all versions through current master (a65ce4b), including 2.1.13","ecosystem":"vendor"},{"name":"iscsi-initiator-utils (Red Hat Enterprise Linux 7-10)","fixed":[],"affected":"RHEL 7, 8, 9, 10","ecosystem":"vendor"}],"ecosystems":[],"tags":["bnx2","infrastructure","iscsi","linux","open-iscsi","qedi","rhel","self-hosted"],"not_affected_if":["no-iscsiuio","no-offload-hardware","software-iscsi-only","static-ip"],"how_to_check":"- Check for hardware offload: lspci | grep -Ei 'bnx2|qlogic|qedi' (Broadcom bnx2/bnx2x or QLogic qedi NICs)\n- Check whether iscsiuio is installed/running: systemctl status iscsiuio.socket iscsiuio.service\n- Check whether the iSCSI iface uses DHCP: iscsiadm -m iface (and the iscsiuio IPv4 config is DHCP)\n- Package version: rpm -q iscsi-initiator-utils or dpkg -l open-iscsi","fix":"No fixed version exists as of 2026-10-25 (upstream open-iscsi master and 2.1.13 still vulnerable; Debian unfixed; Red Hat RHEL 7-10 affected, no errata). Upstream fix proposed in the bugzilla: pass uip_datalen - DHCP_MSG_LEN - 4 to parse_options in parse_msg(). Mitigate: use static IPs for iSCSI boot, or restrict the L2 segment and DHCP/BOOTP traffic to trusted hosts.","status":"open","published_at":"2026-10-23T01:16:53+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:14:16+00:00","updated_at":"2026-10-25T03:16:19+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-25T03:14:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"open-iscsi iscsiuio: DHCP option parsing over-reads heap, crashes daemon","impact":"medium","summary":"The iscsiuio daemon in open-iscsi miscalculates the length of DHCPv4 option data and reads past its heap buffer. A crafted DHCP response from the same network segment can crash the daemon or corrupt its network configuration.","category":"infrastructure","nicknames":[],"who_cares":["open-iscsi","iscsi","linux","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Daemon crashes or network configuration gets corrupted by a crafted DHCP reply","analyst_note":"Find affected and fixed open-iscsi versions in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115484 and the upstream open-iscsi commit.","how_to_check":"- Run `iscsiuio --version` or check the installed open-iscsi package version\n- Check whether the iscsiuio service is running with `systemctl status iscsiuio`\n- Confirm whether the host uses iSCSI boot or offload with DHCP via `iscsiadm -m iface`","needs_analyst":true,"not_affected_if":["no-iscsiuio","software-iscsi-only"],"who_is_affected":"Hosts that run the iscsiuio daemon from open-iscsi, typically iSCSI offload or boot setups that obtain network configuration over DHCPv4. Hosts that do not run iscsiuio, or that use only software iSCSI without offload, are unlikely to be exposed. The sources do not name affected versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000641,"input_tokens":3354,"output_tokens":612,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed open-iscsi versions in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115484 and the upstream open-iscsi commit.","search":"'-10':32A '-115484':16A,19A '-2026':15A,18A '7':31A 'adjac':116C 'alloc':113C 'attack':120C 'beyond':111C 'bnx2':33B 'buffer':64B,114C 'calcul':100C 'caus':107C 'compon':90C 'configur':82B,140C 'corrupt':79B,137C 'craft':66B,129C 'crash':12A,75B,133C 'cve':14A,17A 'daemon':13A,47B,77B,135C 'data':58B,106C 'dhcp':5A,67B,130C 'dhcpv4':56B,96C 'enterprise':29A 'flaw':84C 'found':86C 'hat':28A 'heap':11A,63B,117C 'host':44B 'incorrect':99C 'infrastructur':34B 'initiator':25A 'iscsi':3A,22A,24A,35B,39B,51B,94C 'iscsi-initiator-utils':23A 'iscsiuio':4A,46B,89C 'length':54B,102C 'linux':30A,36B 'memori':118C 'miscalcul':52B 'network':72B,81B,124C,139C 'open':2A,21A,38B,50B,93C 'open-iscsi':1A,20A,37B,49B,92C 'option':6A,57B,97C,105C 'over-read':8A 'pars':7A 'parser':98C 'past':61B 'qedi':40B 'read':10A,60B,110C 'red':27A 'respons':68B,131C 'rhel':41B 'segment':73B,125C 'self':43B 'self-host':42B 'send':127C 'utils':26A","nicknames":[],"mitigations":[],"who_affected":"Hosts that run iscsiuio with IPv4 DHCP on hardware iSCSI offload NICs (Broadcom bnx2/bnx2x, QLogic qedi), typically iSCSI-boot servers. An attacker on the same L2 segment who can spoof a DHCP reply can crash the daemon and cut storage connectivity. Software-iSCSI-only hosts, hosts without iscsiuio, or those on static IPs can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T01:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115484","severity":null,"published_at":"2026-10-23T01:16:53+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115484","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115484","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115484:683","url":null,"severity":null,"published_at":"2026-10-25T03:16:19+00:00","modified_at":"2026-10-25T03:16:19+00:00","first_seen_at":"2026-10-25T03:16:19+00:00","fetched_at":"2026-10-25T03:16:19+00:00","note":"Red Hat advisory+bugzilla 2556265: no upstream fix as of master a65ce4b; distinct from CVE-2026-18728 (fixed in 2.1.13). Debian lists unfixed incl. 2.1.13-1. Red Hat rates Moderate; only hardware iSCSI offload NICs (bnx2/bnx2x, qedi) with DHCPv4."}],"documents":[{"id":3093,"url":"https://access.redhat.com/security/cve/CVE-2026-115484","title":"Red Hat CVE-2026-115484","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3094,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556265","title":"Red Hat Bugzilla 2556265: iscsiuio parse_msg OOB read","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3095,"url":"https://security-tracker.debian.org/tracker/CVE-2026-115484","title":"Debian tracker CVE-2026-115484 (unfixed)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}