DEBIAN-CVE-2026-18727
A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.
DEBIAN-CVE-2026-18727
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-18727
open-iscsi
Source reference: /affected/0/package/name
- Affected versions
- 2.1.8-1
Source reference:
/affected/0/versions - Fixed versions
- 2.1.8-1+deb12u1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
open-iscsi
Source reference: /affected/1/package/name
- Affected versions
- 2.1.11-1
Source reference:
/affected/1/versions2.1.11-1+deb13u1Source reference:
/affected/1/versions2.1.11-1+deb13u2Source reference:
/affected/1/versions2.1.11-2Source reference:
/affected/1/versions2.1.11-3Source reference:
/affected/1/versions2.1.11-4Source reference:
/affected/1/versions2.1.11-5Source reference:
/affected/1/versions2.1.11-6Source reference:
/affected/1/versions2.1.12-1Source reference:
/affected/1/versions2.1.12-2Source reference:
/affected/1/versions2.1.13-1Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
open-iscsi
Source reference: /affected/2/package/name
- Affected versions
- 2.1.11-1
Source reference:
/affected/2/versions2.1.11-2Source reference:
/affected/2/versions2.1.11-3Source reference:
/affected/2/versions2.1.11-4Source reference:
/affected/2/versions2.1.11-5Source reference:
/affected/2/versions2.1.11-6Source reference:
/affected/2/versions2.1.12-1Source reference:
/affected/2/versions2.1.12-2Source reference:
/affected/2/versions - Fixed versions
- 2.1.13-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.8-1+deb12u1"
}
]
}
],
"package": {
"name": "open-iscsi",
"purl": "pkg:deb/debian/open-iscsi?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.1.8-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18727.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "open-iscsi",
"purl": "pkg:deb/debian/open-iscsi?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2.1.11-1",
"2.1.11-1+deb13u1",
"2.1.11-1+deb13u2",
"2.1.11-2",
"2.1.11-3",
"2.1.11-4",
"2.1.11-5",
"2.1.11-6",
"2.1.12-1",
"2.1.12-2",
"2.1.13-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18727.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.13-1"
}
]
}
],
"package": {
"name": "open-iscsi",
"purl": "pkg:deb/debian/open-iscsi?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"2.1.11-1",
"2.1.11-2",
"2.1.11-3",
"2.1.11-4",
"2.1.11-5",
"2.1.11-6",
"2.1.12-1",
"2.1.12-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18727.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]- Related CVEs
- CVE-2026-18727
Source reference:
/upstream
Publisher severity
medium
Source reference: /severity/0/score
- Event
- #67657 · Revision 1
- Added to Heist Feed
- Publisher date