CVE-2026-55995

A flaw was found in open-iscsi. An unauthenticated man-in-the-middle (MITM) attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service (DoS) condition, making the affected system unavailable.

This Important severity flaw in open-iscsi allows an unauthenticated Man-in-the-Middle (MITM) attacker to trigger a denial of service in the iSNS attribute decoder. The vulnerability is network-exploitable without requiring user interaction or authentication, posing a significant risk to the availability of iSNS services in environments where the isns-utils package is deployed and the iSNS service is exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If the iSNS service is not actively used, disable it to prevent exploitation. To disable the isnsd service, execute systemctl disable --now isnsd. If the iSNS service is required, restrict network access to UDP port 3260 to only trusted hosts and networks using firewall rules. A service restart may be required for changes to take effect.