Every CVE Search/ Get API key

CVE-2026-102253

iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

8.7 HighPublic exploitFix available

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.43%Unchanged since Sep 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

Record
CVE-2026-102253
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
EUVDEUVD-2026-89415 8.7

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

Record
EUVD-2026-89415
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-jhpr-vprv-wh8f 8.7

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows...

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

Record
GHSA-jhpr-vprv-wh8f
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
NVD 8.7

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

Record
CVE-2026-102253
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
OSVBELL-CVE-2026-102253 7.5
Record
BELL-CVE-2026-102253
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 8.7

iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

Record
CVE-2026-102253
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-835
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2026-102253 8.7

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

Record
DEBIAN-CVE-2026-102253
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVRLSA-2026:88207 7.5

Important: iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

Security Fix(es):

  • iperf3: iperf3: Denial of Service via UDP receive worker infinite loop (CVE-2026-102253)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:88207
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-102253 8.7

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

Record
UBUNTU-CVE-2026-102253
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:88207 No score

Important: iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

Security Fix(es):

  • iperf3: iperf3: Denial of Service via UDP receive worker infinite loop (CVE-2026-102253)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:88207
Updated
2026-11-02
OSVAZL-105051 No score

CVE-2026-102253 affecting package iperf3 for versions less than 3.17.1-7

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

Record
AZL-105051
Updated
2026-11-05
OSVMGASA-2026-0539 No score

Updated iperf package fixes security vulnerabilities

Iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion. (CVE-2026-71217) Unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion. (CVE-2026-71218) Iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream. (CVE-2026-101276) Iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken. (CVE-2026-101283) Iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS. (CVE-2026-102253)

Record
MGASA-2026-0539
Updated
2026-11-02
OSVopenSUSE-SU-2026:12060-1 No score

iperf-3.22-1.1 on GA media

These are all security issues fixed in the iperf-3.22-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12060-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22090-1 No score

Security update for iperf

This update for iperf fixes the following issues:

  • CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (bsc#1284405).
  • CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion (bsc#1284404).
  • CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per- test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).
  • CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).
  • CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an infinite loop (bsc#1283528).

Changes for iperf:

  • Updated to version 3.22
Record
openSUSE-SU-2026:22090-1
Updated
2026-11-02
OSVSUSE-SU-2026:24178-1 No score

Security update for iperf

This update for iperf fixes the following issues:

  • CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (bsc#1284405).
  • CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion (bsc#1284404).
  • CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per- test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).
  • CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).
  • CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an infinite loop (bsc#1283528).

Changes for iperf:

  • Updated to version 3.22
Record
SUSE-SU-2026:24178-1
Updated
2026-11-02
OSVSUSE-SU-2026:24234-1 No score

Security update for iperf

This update for iperf fixes the following issues:

  • CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (bsc#1284405).
  • CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion (bsc#1284404).
  • CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per- test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).
  • CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).
  • CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an infinite loop (bsc#1283528).

Changes for iperf:

  • Updated to version 3.22
Record
SUSE-SU-2026:24234-1
Updated
2026-11-02
OSVSUSE-SU-2026:4678-1 No score

Security update for iperf

This update for iperf fixes the following issues:

  • CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (bsc#1284405).
  • CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion (bsc#1284404).
  • CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per- test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).
  • CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).
  • CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an infinite loop (bsc#1283528).

Changes for iperf:

  • Updated to version 3.22.
Record
SUSE-SU-2026:4678-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
iperf3
AlmaLinux:10
 before 3.17.1-6.el10_2.2
3.17.1-6.el10_2.2
iperf3
Azure Linux:3
 before 3.17.1-7
3.17.1-7
iperf3
Alpaquita:23
 3.12-r0 up to 3.22-r0
3.22-r0
iperf3
Alpaquita:25
 3.19-r0 up to 3.22-r0
3.22-r0
iperf3
Alpaquita:stream
 3.12-r0 up to 3.22-r0
3.22-r0
iperf3
Debian:13
 All versions, plus listed versions
3.18-23.18-2+deb13u13.18-2+deb13u23.19.1-13.19.1-2
Show 4 moreShow less
3.20-13.20-23.20-2.13.22-0.1
 None known
iperf3
Debian:14
 before 3.22-0.1, plus listed versions
3.18-23.19.1-13.19.1-23.20-13.20-23.20-2.1
3.22-0.1
iperf
Mageia:10
From an advisory covering 5 CVEs
 before 3.22-1.mga10
3.22-1.mga10
iperf3
Rocky Linux:10
 before 0:3.17.1-6.el10_2.2
0:3.17.1-6.el10_2.2
iperf
SUSE:Linux Micro Extras 6.2
From an advisory covering 5 CVEs
 before 3.21-160000.1.1
3.21-160000.1.1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
iperf
SUSE:Linux Enterprise Server 16.0
From an advisory covering 5 CVEs
 before 3.21-160000.1.1
3.21-160000.1.1
iperf
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 5 CVEs
 before 3.21-160000.1.1
3.21-160000.1.1
iperf
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 5 CVEs
 before 3.22-150000.3.18.1
3.22-150000.3.18.1
iperf
SUSE:Enterprise Storage 7.1
From an advisory covering 5 CVEs
 before 3.22-150000.3.18.1
3.22-150000.3.18.1
iperf3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.0.11-13.0.11-1ubuntu0.1~esm13.0.11-1ubuntu0.1~esm2
 None known
iperf3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.3-13.1.3-1ubuntu0.1~esm1
 None known
iperf3
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.6-23.7-13.7-23.7-33.7-3ubuntu0.1~esm13.7-3ubuntu0.1~esm2
 None known
iperf3
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
3.9-13.9-1build13.9-1+deb11u1build0.22.04.13.9-1+deb11u1ubuntu0.1~esm13.9-1+deb11u1ubuntu0.1
 None known
iperf3
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.14-13.15-13.16-13.16-1build13.16-1build23.16-1ubuntu0.1~esm1
 None known
iperf3
Ubuntu:26.10
 All versions, plus listed versions
3.20-23.20-2.13.20-2.1build1
 None known
iperf3
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.18-23.19.1-23.20-2
 None known
iperf
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 3.22-1.1
3.22-1.1
iperf
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 3.21-160000.1.1
3.21-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubRavi-lk/CVE-2026-102253-POC2026-10-07

History

History
RecordedChangedSources
affected
factsOSV
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-102253 is a high vulnerability (CVSS 8.7) in Es Iperf3, published September 29, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in iperf3 3.17.1-6.el10_2.2.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open