Read the docs
TI-2026-40390 Aliases CVE-2026-55995GHSA-93fw-mwmg-2g5m

Double-free in the iSNS attribute decoder in open-iscsi

Priority MEDIUM 43CWE-415Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-415 and the CVSS impact.

Summary

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00252 16th percentileScored 2026-11-07
Fix Fixed Red Hat: 10 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

Red Hat 10 advisories

  • RHSA-2026:61249 Released 2026-08-31 · Red Hat rating Important
    isns-utils security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) isns-utils-0.99-1.el8_4.1, isns-utils-devel-0.99-1.el8_4.1, isns-utils-libs-0.99-1.el8_4.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) isns-utils-0.99-1.el8_4.1, isns-utils-devel-0.99-1.el8_4.1, isns-utils-libs-0.99-1.el8_4.1
  • RHSA-2026:60385 Released 2026-08-26 · Red Hat rating Important
    isns-utils security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) isns-utils-0.99-1.el8_6.1, isns-utils-devel-0.99-1.el8_6.1, isns-utils-libs-0.99-1.el8_6.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) isns-utils-0.99-1.el8_6.1, isns-utils-devel-0.99-1.el8_6.1, isns-utils-libs-0.99-1.el8_6.1
  • RHSA-2026:60333 Released 2026-08-26 · Red Hat rating Important
    isns-utils security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) isns-utils-0.99-1.el8_8.1, isns-utils-devel-0.99-1.el8_8.1, isns-utils-libs-0.99-1.el8_8.1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) isns-utils-0.99-1.el8_8.1, isns-utils-devel-0.99-1.el8_8.1, isns-utils-libs-0.99-1.el8_8.1
Show 7 more Red Hat advisories
  • RHSA-2026:60006 Released 2026-08-26 · Red Hat rating Important
    isns-utils security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) isns-utils-0.101-4.el9_6.1, isns-utils-libs-0.101-4.el9_6.1
  • RHSA-2026:59996 Released 2026-08-26 · Red Hat rating Important
    isns-utils security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) isns-utils-0.101-4.el9_4.1, isns-utils-libs-0.101-4.el9_4.1
  • RHSA-2026:60005 Released 2026-08-26 · Red Hat rating Important
    isns-utils security update
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) isns-utils-0.103-1.el10_0.1, isns-utils-libs-0.103-1.el10_0.1
  • RHSA-2026:59999 Released 2026-08-26 · Red Hat rating Important
    isns-utils security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) isns-utils-0.101-4.el9_2.1, isns-utils-libs-0.101-4.el9_2.1
  • RHSA-2026:53848 Released 2026-08-11 · Red Hat rating Important
    isns-utils security update
    • Red Hat Enterprise Linux BaseOS (v. 8) isns-utils-0.99-1.el8_10.1, isns-utils-devel-0.99-1.el8_10.1, isns-utils-libs-0.99-1.el8_10.1
  • RHSA-2026:53847 Released 2026-08-11 · Red Hat rating Important
    isns-utils security update
    • Red Hat Enterprise Linux BaseOS (v. 9) isns-utils-0.101-4.el9_8.1, isns-utils-libs-0.101-4.el9_8.1
  • RHSA-2026:53846 Released 2026-08-11 · Red Hat rating Important
    isns-utils security update
    • Red Hat Enterprise Linux BaseOS (v. 10) isns-utils-0.103-1.el10_2.1, isns-utils-libs-0.103-1.el10_2.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:53846
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:53848
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:53847
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:61249
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:60385
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:60333
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:59999
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:59996
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:60005
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:60006
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:61249
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:60385
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:60333

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55995
  2. 2026-10-03 Alias added: GHSA-93fw-mwmg-2g5m

References

Other 2

  • TI-2026-32810 iscsiuio control-socket authentication bypass in open-iscsi CVSS 4.0HIGH 8.5
  • TI-2026-32809 remote limited file-write as root via discovery in open-iscsi CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences