---
id: CVE-2026-18726
title: >-
  Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement
  parsing
summary: >-
  A flaw was found in open-iscsi. This vulnerability allows a remote attacker on
  the same local network segment to cause a Denial of Service (DoS) in the
  iscsiuio daemon. By sending a specially crafted Internet Control Message
  Protocol ver…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-835
vendor: Red Hat
product: iscsi-initiator-utils
affected:
  - iscsi-initiator-utils (all versions)
  - iscsi-initiator-utils (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-13T13:42:48.403070Z'
published: '2026-08-12'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:25:48.728Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-18726'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-18726'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2462331'
    label: RHBZ#2462331
tags:
  - cve.org
epss: 0.00312
epssPercentile: 0.24275
ingestedAt: '2026-11-05T22:38:31.541Z'
---

## Overview

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.

## Affected

- `iscsi-initiator-utils (all versions)`
- `iscsi-initiator-utils (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, restrict ICMPv6 Router Advertisements from untrusted sources on any network segment where `iscsiuio` interfaces are exposed. Alternatively, disable IPv6 Router Advertisement processing on affected interfaces if not operationally required. This may involve configuring firewall rules to filter ICMPv6 type 134 messages or adjusting network interface settings to prevent RA-driven IPv6 configuration. A service restart may be required for changes to take effect.