Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

iperf3 can be forced to stop responding remotely

published 2 months ago

Summary

The iperf3 network testing tool’s server can be sent specially crafted data that makes it use up all its memory or CPU, causing it to become unresponsive. This could interrupt any monitoring or testing that relies on iperf3. Apply the latest iperf3 update as soon as possible to stop this from happening.

What to do

Update rocky iperf3 to version 0:3.17.1-6.el10_2.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Rocky Linux:10	rocky	iperf3	< 0:3.17.1-6.el10_2.1 Fix: upgrade to 0:3.17.1-6.el10_2.1

Original advisory text

Important: iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

Security Fix(es):

* iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (CVE-2026-71217)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://errata.rockylinux.org/RLSA-2026:61680 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2460984 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:61680 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published1 Sep 2026

Updated1 Sep 2026

First seen1 Sep 2026

Sources

RLSA-2026:61680 · OSV

Track software like this

Free during beta