QSN-8807-1: Open-iSNS vulnerability
2026-09-23

Summary:
Open-iSNS could be made to crash if it received specially crafted network
traffic.

Details:
It was discovered that Open-iSNS contained a double-free vulnerability when
decoding malformed iSNS attributes. An unauthenticated attacker could possibly
 use this to cause a denial of service.

Affected QuantaStor releases:
  6.9.1.001 jammy: libisns0 0.101-0ubuntu2.1 (fixed in 0.101-0ubuntu2.1)
  6.9.0.464 jammy: libisns0 0.101-0ubuntu2.1 (fixed in 0.101-0ubuntu2.1)
  6.8.6.015 jammy: libisns0 0.101-0ubuntu2 (fixed in 0.101-0ubuntu2.1)
  6.8.5.018 jammy: libisns0 0.101-0ubuntu2 (fixed in 0.101-0ubuntu2.1)
  6.8.4.038 jammy: libisns0 0.101-0ubuntu2 (fixed in 0.101-0ubuntu2.1)
  6.8.3.018 jammy: libisns0 0.101-0ubuntu2 (fixed in 0.101-0ubuntu2.1)
  6.8.2.002 jammy: libisns0 0.101-0ubuntu2 (fixed in 0.101-0ubuntu2.1)
  6.8.1.007 jammy: libisns0 0.101-0ubuntu2 (fixed in 0.101-0ubuntu2.1)
  6.8.0.205 jammy: libisns0 0.101-0ubuntu2 (fixed in 0.101-0ubuntu2.1)

CVEs: CVE-2026-55995

References:
  https://ubuntu.com/security/notices/USN-8807-1