Hi,

The following vulnerabilities were published for open-iscsi.

Could you check if those are reported upstream already?

CVE-2026-115484[0]:
| A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4
| option parser incorrectly calculates the length of the options data,
| causing it to read beyond the allocated buffer into adjacent heap
| memory. An attacker on the same network segment can send a crafted
| DHCP response to crash the daemon or corrupt its network
| configuration.


CVE-2026-115485[1]:
| A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6
| option parser calls strlen() on raw network data without ensuring a
| NUL terminator is present, causing it to read past the buffer into
| heap memory. This can result in a daemon crash, a 1-byte heap
| overwrite, or corruption of the iSCSI initiator name. An attacker on
| the same network segment can trigger this by sending a crafted
| DHCPv6 Advertise message.


CVE-2026-115486[2]:
| A flaw was found in the iscsiuio component of open-iscsi. The IPv6
| Neighbor Discovery handler accesses link-layer address options at a
| fixed offset without verifying the packet contains them.
| Additionally, the ARP table is updated unconditionally with
| attacker-controlled addresses from the packet headers. An attacker
| on the same network segment can send a minimal Neighbor
| Advertisement to poison the ARP table and redirect network traffic.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-115484
https://www.cve.org/CVERecord?id=CVE-2026-115484
[1] https://security-tracker.debian.org/tracker/CVE-2026-115485
https://www.cve.org/CVERecord?id=CVE-2026-115485
[2] https://security-tracker.debian.org/tracker/CVE-2026-115486
https://www.cve.org/CVERecord?id=CVE-2026-115486

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore