Every CVE Search/ Get API key

CVE-2025-54351

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in...

8.9 HighFix available

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

0.47%Up 0.4 points since Aug 3, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.9

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

Record
CVE-2025-54351
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-420
Updated
2026-11-02
EUVDEUVD-2025-23458 8.9

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

Record
EUVD-2025-23458
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-xjwm-4pfw-49g2 8.9

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in...

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

Record
GHSA-xjwm-4pfw-49g2
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-420
Updated
2026-11-02
NVD 8.9

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

Record
CVE-2025-54351
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-420
Updated
2026-11-02
OSVALPINE-CVE-2025-54351 10.0

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

Record
ALPINE-CVE-2025-54351
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2025-54351 10.0
Record
BELL-CVE-2025-54351
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSV 8.9

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

Record
CVE-2025-54351
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-420
Updated
2026-11-02
OSVUBUNTU-CVE-2025-54351 8.9

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

Record
UBUNTU-CVE-2025-54351
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-06
OSVopenSUSE-SU-2025:15414-1 No score

iperf-3.19.1-1.1 on GA media

These are all security issues fixed in the iperf-3.19.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15414-1
Updated
2026-11-02
OSVSUSE-SU-2025:02749-1 No score

Security update for iperf

This update for iperf fixes the following issues:

  • update to 3.19.1:

    • CVE-2025-54351: Fixed buffer overflow in net.c (bsc#1247522)
    • CVE-2025-54350: Fixed Base64Decode assertion failure and application exit upon a malformed authentication attempt (bsc#1247520)
    • CVE-2025-54349: Fixed off-by-one error and resultant heap-based buffer overflow (bsc#1247519)

  • update to 3.19:

    • iperf3 now supports the use of Multi-Path TCP (MPTCPv1) on Linux with the use of the -m or --mptcp flag. (PR #1661)
    • iperf3 now supports a --cntl-ka option to enable TCP keepalives on the control connection. (#812, #835, PR #1423)
    • iperf3 now supports the MSG_TRUNC receive option, specified by the --skip-rx-copy. This theoretically improves the rated throughput of tests at high bitrates by not delivering network payload data to userspace. (#1678, PR #1717)
    • A bug that caused the bitrate setting to be ignored when bursts are set, has been fixed. (#1773, #1820, PR #1821, PR #1848)
    • The congestion control protocol setting, if used, is now properly reset between tests. (PR #1812)
    • iperf3 now exits with a non-error 0 exit code if exiting via a SIGTERM, SIGHUP, or SIGINT. (#1009, PR# 1829)
    • The current behavior of iperf3 with respect to the -n and -k options is now documented as correct. (#1768, #1775, #596, PR #1800)
Record
SUSE-SU-2025:02749-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
iperf3
Alpine:v3.22
 before 3.19.1-r0
3.19.1-r0
iperf3
Alpine:v3.23
 before 3.19.1-r0
3.19.1-r0
iperf3
Alpine:v3.24
 before 3.19.1-r0
3.19.1-r0
iperf3
Alpaquita:23
 3.12-r0 up to 3.22-r0
3.22-r0
iperf3
Alpaquita:25
 3.19-r0 up to 3.19.1-r0
3.19.1-r0
iperf3
Alpaquita:stream
 3.12-r0 up to 3.19.1-r0
3.19.1-r0
iperf
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 3 CVEs
 before 3.19.1-150000.3.15.1
3.19.1-150000.3.15.1
iperf
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 3 CVEs
 before 3.19.1-150000.3.15.1
3.19.1-150000.3.15.1
iperf
SUSE:Enterprise Storage 7.1
From an advisory covering 3 CVEs
 before 3.19.1-150000.3.15.1
3.19.1-150000.3.15.1
iperf
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 3.19.1-150000.3.15.1
3.19.1-150000.3.15.1
iperf3
Ubuntu:25.10
 All versions, plus listed versions
3.18-23.18-2ubuntu0.1
 None known
iperf3
Ubuntu:26.10
 All versions, plus listed versions
3.20-23.20-2.13.20-2.1build1
 None known
iperf
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 3.19.1-1.1
3.19.1-1.1

History

History
RecordedChangedSources
affectedOSV
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-54351 is a high vulnerability (CVSS 8.9) in Es Iperf3, published August 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in iperf3 3.19.1-r0.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open