Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

iperf3 can be crashed by unauthenticated client

CVE-2026-101283 · published 18 days ago
Summary

Versions 3.20 through 3.21 of iperf3 may let anyone connect and send specially crafted data that overflows memory, potentially causing the program to stop working or be taken over. The issue does not require valid credentials, so it can be triggered from outside your network. Upgrade iperf3 to version 3.22 or later to remove the risk.

What to do
  • Update debian iperf3 to version 3.22-0.1.
  • Update bellsoft iperf3 to version 3.22-r0.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian iperf3 All versions
Debian:13 debian iperf3 All versions
Debian:14 debian iperf3 < 3.22-0.1
Fix: upgrade to 3.22-0.1
– esnet iperf3 3.20
Ubuntu:Pro:16.04:LTS canonical iperf3 All versions
Alpaquita:stream bellsoft iperf3 >= 3.12-r0
>= 3.12-r0, < 3.22-r0
Fix: upgrade to 3.22-r0
Original advisory text
BELL-CVE-2026-101283
iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published30 Sep 2026
Updated17 Oct 2026
First seen30 Sep 2026
Sources
DEBIAN-CVE-2026-101283 · OSV
CVE-2026-101283 · NVD
CVE-2026-101283 · MITRE
UBUNTU-CVE-2026-101283 · OSV
BELL-CVE-2026-101283 · OSV
Track software like this
Free during beta