CVE-Katalog
CVE-2026-115486
open-iscsi: CVE-2026-115486
- Schweregrad
- High · CVSS 7.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Published
- Source
- [NVD] · [CVE record]
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | open-iscsi | sid | 2.1.13-1 | vulnerable |
| Debian | open-iscsi | forky | 2.1.13-1 | vulnerable |
| Debian | open-iscsi | trixie | 2.1.11-1+deb13u2 | vulnerable |
| Debian | open-iscsi | bookworm | 2.1.8-1 | vulnerable |
| Debian | open-iscsi | bookworm-security | 2.1.8-1+deb12u1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | open-iscsi | source | sid | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | open-iscsi | source | forky | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | open-iscsi | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | open-iscsi | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [iscsiuio]Betroffen
Quellpaket: [open-iscsi]
Details (2)
2.1.8-1· amd64 · bookwormBetroffen
dsa · open-iscsi · debian · bookworm
2.1.8-1· arm64 · bookwormBetroffen
dsa · open-iscsi · debian · bookworm
- [libopeniscsiusr]Betroffen
Quellpaket: [open-iscsi]
Details (2)
2.1.8-1· amd64 · bookwormBetroffen
dsa · open-iscsi · debian · bookworm
2.1.8-1· arm64 · bookwormBetroffen
dsa · open-iscsi · debian · bookworm
- [libopeniscsiusr-dev]Betroffen
Quellpaket: [open-iscsi]
Details (2)
2.1.8-1· all · bookwormBetroffen
dsa · open-iscsi · debian · bookworm
2.1.8-1· all · bookwormBetroffen
dsa · open-iscsi · debian · bookworm
- [open-iscsi]Betroffen
Details (2)
2.1.8-1· amd64 · bookwormBetroffen
dsa · open-iscsi · debian · bookworm
2.1.8-1· arm64 · bookwormBetroffen
dsa · open-iscsi · debian · bookworm
Beobachtet: