Description
A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.
Published: 2026-08-13
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in open-iscsi’s iscsiuio component triggers an integer underflow during the parsing of IPv4 DHCP replies, resulting in an out‑of‑bounds read. When a specially crafted DHCP packet is received, iscsiuio crashes, causing the iSCSI service to become unavailable. The vulnerability is a classic integer underflow (CWE‑191) and does not provide code execution or privilege escalation. It directly affects the availability of iSCSI targets and initiators that rely on iscsiuio for IPv4 DHCP handling.

Affected Systems

Red Hat Enterprise Linux 10 and Red Hat Enterprise Linux 9 systems that have the iscsiuio service enabled and actively handling IPv4 DHCP traffic. The flaw is specific to the iscsiuio component of open‑iscsi.

Risk and Exploitability

The rated CVSS score of 6.5 indicates moderate severity. Exploitation is limited to attackers who can send crafted DHCP packets on the same local network segment; no network traversal or authentication is required. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting that widespread exploitation is not yet confirmed but remains plausible for entities with exposed DHCP traffic.

Generated by OpenCVE AI on August 13, 2026 at 05:21 UTC.

Remediation

Vendor Workaround

To mitigate this issue, restrict network access to `iscsiuio`-managed interfaces. Configure firewall rules to limit DHCP/BOOTP traffic to only trusted infrastructure within the local broadcast domain. This reduces the exposure to untrusted systems that could send crafted IPv4 DHCP packets. If `iscsiuio` is actively using IPv4 DHCP, consider reconfiguring it to use static IP addresses or a different network configuration if feasible. Changes to network configuration may require a service restart.

OpenCVE Recommended Actions

  • Restrict network access to iscsiuio‑managed interfaces by configuring firewall rules that limit DHCP/BOOTP traffic to trusted infrastructure within the local broadcast domain.
  • If iscsiuio is actively using IPv4 DHCP, consider reconfiguring it to use static IP addresses or a different network configuration and restart the service after changes.
  • Regularly check the vendor’s website for updates or patches for open-iscsi, and apply any forthcoming security patches as soon as they become available.

Generated by OpenCVE AI on August 13, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Fri, 14 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 13 Aug 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat open Iscsi
Vendors & Products Redhat open Iscsi

Thu, 13 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.
Title Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-191
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Enterprise Linux Open Iscsi
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-18T14:37:36.014Z

Reserved: 2026-08-03T17:55:57.114Z

Link: CVE-2026-18728

cve-icon Vulnrichment

Updated: 2026-08-14T22:24:14.895Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-13T04:17:19.340

Modified: 2026-08-25T15:04:06.220

Link: CVE-2026-18728

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-12T18:05:24Z

Links: CVE-2026-18728 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T10:39:06Z

Weaknesses
  • CWE-191

    Integer Underflow (Wrap or Wraparound)