Every CVE Search/ Get API key

CVE-2026-101276

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's...

9.2 CriticalFix available

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.40%Unchanged since Oct 1, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.2

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.

Record
CVE-2026-101276
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2026-90387 9.2

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.

Record
EUVD-2026-90387
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-pmgg-x2vj-36cv 9.2

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's...

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.

Record
GHSA-pmgg-x2vj-36cv
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-416
Updated
2026-11-02
NVD 9.2

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.

Record
CVE-2026-101276
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-416
Updated
2026-11-02
OSVDEBIAN-CVE-2026-101276 9.2

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.

Record
DEBIAN-CVE-2026-101276
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-101276 9.2

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.

Record
UBUNTU-CVE-2026-101276
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
Show 7 moreShow less
OSVAZL-105492 No score

CVE-2026-101276 affecting package iperf3 3.17.1-6

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.

Record
AZL-105492
Updated
2026-11-02
OSVMGASA-2026-0539 No score

Updated iperf package fixes security vulnerabilities

Iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion. (CVE-2026-71217) Unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion. (CVE-2026-71218) Iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream. (CVE-2026-101276) Iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken. (CVE-2026-101283) Iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS. (CVE-2026-102253)

Record
MGASA-2026-0539
Updated
2026-11-02
OSVopenSUSE-SU-2026:12060-1 No score

iperf-3.22-1.1 on GA media

These are all security issues fixed in the iperf-3.22-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12060-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22090-1 No score

Security update for iperf

This update for iperf fixes the following issues:

  • CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (bsc#1284405).
  • CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion (bsc#1284404).
  • CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per- test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).
  • CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).
  • CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an infinite loop (bsc#1283528).

Changes for iperf:

  • Updated to version 3.22
Record
openSUSE-SU-2026:22090-1
Updated
2026-11-02
OSVSUSE-SU-2026:24178-1 No score

Security update for iperf

This update for iperf fixes the following issues:

  • CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (bsc#1284405).
  • CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion (bsc#1284404).
  • CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per- test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).
  • CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).
  • CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an infinite loop (bsc#1283528).

Changes for iperf:

  • Updated to version 3.22
Record
SUSE-SU-2026:24178-1
Updated
2026-11-02
OSVSUSE-SU-2026:24234-1 No score

Security update for iperf

This update for iperf fixes the following issues:

  • CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (bsc#1284405).
  • CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion (bsc#1284404).
  • CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per- test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).
  • CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).
  • CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an infinite loop (bsc#1283528).

Changes for iperf:

  • Updated to version 3.22
Record
SUSE-SU-2026:24234-1
Updated
2026-11-02
OSVSUSE-SU-2026:4678-1 No score

Security update for iperf

This update for iperf fixes the following issues:

  • CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (bsc#1284405).
  • CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion (bsc#1284404).
  • CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per- test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).
  • CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).
  • CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an infinite loop (bsc#1283528).

Changes for iperf:

  • Updated to version 3.22.
Record
SUSE-SU-2026:4678-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
iperf3
Azure Linux:3
 through 3.17.1-6 None known
iperf3
Alpaquita:25
 3.19-r0 up to 3.22-r0
3.22-r0
iperf3
Alpaquita:stream
 3.16-r0 up to 3.22-r0
3.22-r0
iperf3
Debian:13
 All versions, plus listed versions
3.18-23.18-2+deb13u13.18-2+deb13u23.19.1-13.19.1-2
Show 4 moreShow less
3.20-13.20-23.20-2.13.22-0.1
 None known
iperf3
Debian:14
 before 3.22-0.1, plus listed versions
3.18-23.19.1-13.19.1-23.20-13.20-23.20-2.1
3.22-0.1
iperf
Mageia:10
From an advisory covering 5 CVEs
 before 3.22-1.mga10
3.22-1.mga10
iperf
SUSE:Linux Micro Extras 6.2
From an advisory covering 5 CVEs
 before 3.21-160000.1.1
3.21-160000.1.1
iperf
SUSE:Linux Enterprise Server 16.0
From an advisory covering 5 CVEs
 before 3.21-160000.1.1
3.21-160000.1.1
iperf
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 5 CVEs
 before 3.21-160000.1.1
3.21-160000.1.1
iperf
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 5 CVEs
 before 3.22-150000.3.18.1
3.22-150000.3.18.1
Show 10 moreShow less
Affected packages
PackageAffectedFixed
iperf
SUSE:Enterprise Storage 7.1
From an advisory covering 5 CVEs
 before 3.22-150000.3.18.1
3.22-150000.3.18.1
iperf3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.0.11-13.0.11-1ubuntu0.1~esm13.0.11-1ubuntu0.1~esm2
 None known
iperf3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.3-13.1.3-1ubuntu0.1~esm1
 None known
iperf3
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.6-23.7-13.7-23.7-33.7-3ubuntu0.1~esm13.7-3ubuntu0.1~esm2
 None known
iperf3
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
3.9-13.9-1build13.9-1+deb11u1build0.22.04.13.9-1+deb11u1ubuntu0.1~esm13.9-1+deb11u1ubuntu0.1
 None known
iperf3
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.14-13.15-13.16-13.16-1build13.16-1build23.16-1ubuntu0.1~esm1
 None known
iperf3
Ubuntu:26.10
 All versions, plus listed versions
3.20-23.20-2.13.20-2.1build1
 None known
iperf3
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.18-23.19.1-23.20-2
 None known
iperf
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 3.22-1.1
3.22-1.1
iperf
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 3.21-160000.1.1
3.21-160000.1.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-101276 is a critical vulnerability (CVSS 9.2) in Es Iperf3, published September 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in iperf3 3.22-r0.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open