Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-29T13:43:22 open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-763

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.

A flaw was found in open-iscsi. An unauthenticated man-in-the-middle (MITM) attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service (DoS) condition, making the affected system unavailable.

This Important severity flaw in `open-iscsi` allows an unauthenticated Man-in-the-Middle (MITM) attacker to trigger a denial of service in the iSNS attribute decoder. The vulnerability is network-exploitable without requiring user interaction or authentication, posing a significant risk to the availability of iSNS services in environments where the `isns-utils` package is deployed and the iSNS service is exposed. Red Hat would like to thank Keith Linneman for reporting this issue. If the iSNS service is not actively used, disable it to prevent exploitation. To disable the `isnsd` service, execute `systemctl disable --now isnsd`. If the iSNS service is required, restrict network access to UDP port 3260 to only trusted hosts and networks using firewall rules. A service restart may be required for changes to take effect. Red Hat Enterprise Linux 10 2026-08-11T00:00:00Z RHSA-2026:53846 isns-utils-0:0.103-1.el10_2.1 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-08-26T00:00:00Z RHSA-2026:60005 isns-utils-0:0.103-1.el10_0.1 Red Hat Enterprise Linux 8 2026-08-11T00:00:00Z RHSA-2026:53848 isns-utils-0:0.99-1.el8_10.1 Red Hat Enterprise Linux 9 2026-08-11T00:00:00Z RHSA-2026:53847 isns-utils-0:0.101-4.el9_8.1 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-08-26T00:00:00Z RHSA-2026:60006 isns-utils-0:0.101-4.el9_6.1 https://www.cve.org/CVERecord?id=CVE-2026-55995 https://nvd.nist.gov/vuln/detail/CVE-2026-55995 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55995 https://github.com/open-iscsi/open-isns/commit/56718d4e9d1a4f51c30697b5c0534144bb41c9bb