Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-101276: iperf3 3.21 may allow remote crash
CVE-2026-101276 · published 18 days ago
Summary
The iperf3 testing tool version 3.21 can be attacked over the network, causing the program to stop working. An attacker can trigger a condition that frees memory while a background thread is still using it, leading to a crash. Upgrade to version 3.22 or later to prevent this issue.
What to do
- Update debian iperf3 to version 3.22-0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | esnet | iperf3 | 3.21 |
| Debian:12 | debian | iperf3 | All versions |
| Debian:13 | debian | iperf3 | All versions |
| Debian:14 | debian | iperf3 |
< 3.22-0.1 Fix: upgrade to 3.22-0.1
|
| Ubuntu:Pro:16.04:LTS | canonical | iperf3 | All versions |
| Alpaquita:25 | bellsoft | iperf3 | >= 3.19-r0 |
| Alpaquita:stream | bellsoft | iperf3 |
>= 3.12-r0 >= 3.16-r0 |
Original advisory text
BELL-CVE-2026-101276
iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.
References
- https://docs.bell-sw.com/security/cves/CVE-2026-101276 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-101276 Vendor Advisory
- https://newreleases.io/project/github/esnet/iperf/release/3.22 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-101276 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-101276 Third Party Advisory
- https://github.com/esnet/iperf/releases/tag/3.22 Third Party Advisory
- https://github.com/esnet/iperf/commit/9bea2d9a49d54870e2405c209fa60bf134a8a1a1 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.9
Critical
Type
CWE-416Use After Free
Timeline
Published30 Sep 2026
Updated17 Oct 2026
First seen30 Sep 2026
Sources
DEBIAN-CVE-2026-101276 · OSV
CVE-2026-101276 · NVD
CVE-2026-101276 · MITRE
UBUNTU-CVE-2026-101276 · OSV
BELL-CVE-2026-101276 · OSV
Track software like this
Free during beta