Threats Tagged 'cve-2026-18726'

A vulnerability in open-iscsi's iscsiuio daemon allows a remote attacker on the same local network segment to cause a denial of service by sending a crafted ICMPv6 Router Advertisement with a zero-length option. This triggers an infinite loop, causing sustained CPU usage and making the daemon unresponsive. There is also a secondary risk of out-of-bounds reads with short IPv6 payloads, but no confirmed memory corruption or data exposure. Exploitation requires adjacency on the same Layer 2 network segment and IPv6 enabled on the interface.

A vulnerability in open-iscsi on Red Hat Enterprise Linux 10 allows a remote attacker on the same local network segment to cause a denial of service in the iscsiuio daemon. By sending a specially crafted ICMPv6 Router Advertisement with a zero-length option, the attacker can trigger an infinite loop, causing sustained CPU usage and making the daemon unresponsive. There is also a secondary risk of out-of-bounds reads with short IPv6 payloads, but no confirmed memory corruption or data exposure. Mitigation involves restricting or filtering ICMPv6 Router Advertisements from untrusted sources or disabling IPv6 Router Advertisement processing on affected interfaces. No official fix or patch is currently confirmed.