CVE-2026-55995

HighCVSS 8.7/10Last modified Jul 30, 2026

Description

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS.

This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-415

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
open-iscsiopen-iscsi>= ?, <= 56718d4e9d1a4f51c30697b5c0534144bb41c9bb

References

Timeline

Published
Jul 29, 2026
Last modified
Jul 30, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-559964.3A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in doCVE-2026-559978.8Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exCVE-2026-559985.3The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID referenceCVE-2026-559997.8Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could CVE-2026-56004.3A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-CVE-2026-560007.8Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could CVE-2026-560018.8A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to aCVE-2026-560028.8A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows attackers authenticated as X clienCVE-2026-560038.8A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() befCVE-2026-5600410.0A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to prCVE-2026-560057.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-CVE-2026-560067.1Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.