{"id":"CVE-2026-115485","kind":"vulnerability","aliases":["CVE-2026-115485"],"related":[],"title":"open-iscsi iscsiuio: crafted DHCPv6 packet crashes daemon, corrupts initiator name","description":"A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.","summary":"The iscsiuio daemon in open-iscsi calls strlen() on DHCPv6 option data that is not NUL-terminated, so it reads past the buffer. An attacker on the same network segment who sends a crafted DHCPv6 Advertise message can crash the daemon, overwrite one byte of heap, or corrupt the iSCSI initiator name.","severity":"medium","cvss":6.3,"epss":0.002,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","iscsi","linux","open-iscsi","self-hosted"],"not_affected_if":["ipv4-only","no-iscsiuio","static-network-config"],"how_to_check":"- Check whether iscsiuio is installed and running, for example with `systemctl status iscsiuio` or `ps -ef | grep iscsiuio`\n- Check the installed open-iscsi version with `iscsiadm --version`, then compare it with the fixed version in the vendor advisory (unknown in the sources)","fix":"- Update open-iscsi to a release that includes the fix for this CVE (fixed version: unknown in the sources)\n- Until patched, stop iscsiuio if your iSCSI setup does not need it, for example `systemctl stop iscsiuio`","status":"open","published_at":"2026-10-23T01:16:53+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:00:10+00:00","updated_at":"2026-10-25T04:00:10+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:00:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update open-iscsi to a release that includes the fix for this CVE (fixed version: unknown in the sources)\n- Until patched, stop iscsiuio if your iSCSI setup does not need it, for example `systemctl stop iscsiuio`","reach":"network","title":"open-iscsi iscsiuio: crafted DHCPv6 packet crashes daemon, corrupts initiator name","impact":"medium","summary":"The iscsiuio daemon in open-iscsi calls strlen() on DHCPv6 option data that is not NUL-terminated, so it reads past the buffer. An attacker on the same network segment who sends a crafted DHCPv6 Advertise message can crash the daemon, overwrite one byte of heap, or corrupt the iSCSI initiator name.","category":"infrastructure","nicknames":[],"who_cares":["linux","iscsi","open-iscsi","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Daemon crashes, heap byte overwritten, iSCSI initiator name corrupted","analyst_note":"Find the fixed open-iscsi version and the vendor advisory for CVE-2026-115485 at the NVD link; sources give no fix or version.","how_to_check":"- Check whether iscsiuio is installed and running, for example with `systemctl status iscsiuio` or `ps -ef | grep iscsiuio`\n- Check the installed open-iscsi version with `iscsiadm --version`, then compare it with the fixed version in the vendor advisory (unknown in the sources)","needs_analyst":true,"not_affected_if":["no-iscsiuio","ipv4-only","static-network-config"],"who_is_affected":"Hosts that run iscsiuio on a network segment where an attacker can send DHCPv6 traffic, typically hosts using iSCSI with IPv6 network configuration through iscsiuio. Systems that do not run iscsiuio, or that use only software iSCSI without its DHCPv6 handling, can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":3393,"output_tokens":731,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115485':15A,18A '-2026':14A,17A '1':129C 'advertis':65B,155C 'attack':54B,141C 'buffer':52B,117C 'byte':73B,130C 'call':35B,98C 'caus':111C 'compon':89C 'corrupt':10A,77B,134C 'craft':5A,63B,153C 'crash':8A,68B,127C 'cve':13A,16A 'daemon':9A,30B,70B,126C 'data':40B,103C 'dhcpv6':6A,38B,64B,95C,154C 'ensur':105C 'flaw':83C 'found':85C 'heap':75B,119C,131C 'host':27B 'infrastructur':19B 'initi':11A,80B,138C 'iscsi':3A,20B,24B,34B,79B,93C,137C 'iscsiuio':4A,29B,88C 'linux':21B 'memori':120C 'messag':66B,156C 'name':12A,81B,139C 'network':58B,102C,145C 'nul':45B,107C 'nul-termin':44B 'one':72B 'open':2A,23B,33B,92C 'open-iscsi':1A,22B,32B,91C 'option':39B,96C 'overwrit':71B,132C 'packet':7A 'parser':97C 'past':50B,115C 'present':110C 'raw':101C 'read':49B,114C 'result':123C 'segment':59B,146C 'self':26B 'self-host':25B 'send':61B,151C 'strlen':36B,99C 'termin':46B,108C 'trigger':148C 'without':104C","nicknames":[],"mitigations":[],"who_affected":"Hosts that run iscsiuio on a network segment where an attacker can send DHCPv6 traffic, typically hosts using iSCSI with IPv6 network configuration through iscsiuio. Systems that do not run iscsiuio, or that use only software iSCSI without its DHCPv6 handling, can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T01:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115485","severity":null,"published_at":"2026-10-23T01:16:53+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115485","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115485","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}