CVE-2026-18726Medium· 6.5▾ SunlitA flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol ver…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.
iscsi-initiator-utils (all versions)iscsi-initiator-utils (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
To mitigate this issue, restrict ICMPv6 Router Advertisements from untrusted sources on any network segment where iscsiuio interfaces are exposed. Alternatively, disable IPv6 Router Advertisement processing on affected interfaces if not operationally required. This may involve configuring firewall rules to filter ICMPv6 type 134 messages or adjusting network interface settings to prevent RA-driven IPv6 configuration. A service restart may be required for changes to take effect.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-18727Medium· 6.5Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing
CVE-2026-18728Medium· 6.5Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing
CVE-2026-110931High· 7.5Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop
CVE-2026-107602High· 7.5Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop
CVE-2026-120194High· 7.5Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step
CVE-2023-3255Medium· 6.5Qemu: vnc: infinite loop in inflate_buffer() leads to denial of service