Skip to content
Heist/ feed
MediumFix available

DEBIAN-CVE-2026-18727

Type: advisorySource: OSV1 source record

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-18727

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-18727

open-iscsi

Source reference: /affected/0/package/name

Affected versions
2.1.8-1

Source reference: /affected/0/versions

Fixed versions
2.1.8-1+deb12u1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

open-iscsi

Source reference: /affected/1/package/name

Affected versions
2.1.11-1

Source reference: /affected/1/versions

2.1.11-1+deb13u1

Source reference: /affected/1/versions

2.1.11-1+deb13u2

Source reference: /affected/1/versions

2.1.11-2

Source reference: /affected/1/versions

2.1.11-3

Source reference: /affected/1/versions

2.1.11-4

Source reference: /affected/1/versions

2.1.11-5

Source reference: /affected/1/versions

2.1.11-6

Source reference: /affected/1/versions

2.1.12-1

Source reference: /affected/1/versions

2.1.12-2

Source reference: /affected/1/versions

2.1.13-1

Source reference: /affected/1/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

open-iscsi

Source reference: /affected/2/package/name

Affected versions
2.1.11-1

Source reference: /affected/2/versions

2.1.11-2

Source reference: /affected/2/versions

2.1.11-3

Source reference: /affected/2/versions

2.1.11-4

Source reference: /affected/2/versions

2.1.11-5

Source reference: /affected/2/versions

2.1.11-6

Source reference: /affected/2/versions

2.1.12-1

Source reference: /affected/2/versions

2.1.12-2

Source reference: /affected/2/versions

Fixed versions
2.1.13-1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.1.8-1+deb12u1"
          }
        ]
      }
    ],
    "package": {
      "name": "open-iscsi",
      "purl": "pkg:deb/debian/open-iscsi?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "2.1.8-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18727.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "open-iscsi",
      "purl": "pkg:deb/debian/open-iscsi?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "2.1.11-1",
      "2.1.11-1+deb13u1",
      "2.1.11-1+deb13u2",
      "2.1.11-2",
      "2.1.11-3",
      "2.1.11-4",
      "2.1.11-5",
      "2.1.11-6",
      "2.1.12-1",
      "2.1.12-2",
      "2.1.13-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18727.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.1.13-1"
          }
        ]
      }
    ],
    "package": {
      "name": "open-iscsi",
      "purl": "pkg:deb/debian/open-iscsi?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "2.1.11-1",
      "2.1.11-2",
      "2.1.11-3",
      "2.1.11-4",
      "2.1.11-5",
      "2.1.11-6",
      "2.1.12-1",
      "2.1.12-2"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18727.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]
Related CVEs
CVE-2026-18727

Source reference: /upstream

Publisher severity

medium

Source reference: /severity/0/score

Event
#67657 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement