{"id":"CVE-2025-54351","aliases":["ALPINE-CVE-2025-54351","BELL-CVE-2025-54351","EUVD-2025-23458","GHSA-xjwm-4pfw-49g2","SUSE-SU-2025:02749-1","UBUNTU-CVE-2025-54351","openSUSE-SU-2025:15414-1"],"status":"published","title":"In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in...","description":"In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).","severity":{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00468,"percentile":0.40989,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-420"],"published":"2025-08-03T00:00:00Z","modified":"2026-11-06T13:51:28Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"iperf3","fixed_in":["3.19.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"iperf3","fixed_in":["3.19.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"iperf3","fixed_in":["3.19.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"iperf3","fixed_in":["3.22-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"iperf3","fixed_in":["3.19.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"iperf3","fixed_in":["3.19.1-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12-r0"},{"fixed":"3.22-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19-r0"},{"fixed":"3.19.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12-r0"},{"fixed":"3.19.1-r0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.3.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.3.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.3.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.3.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.18-2","3.18-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20-2","3.20-2.1","3.20-2.1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-1.1"}]}],"bundled":3}],"products":[{"vendor":"es","product":"iperf3"}],"references":[{"url":"https://github.com/esnet/iperf/releases/tag/3.19.1","tags":["Release Notes","web","report"]},{"url":"https://github.com/esnet/iperf/commit/969b7f70c447513e92c9798f22e82b40ebc53bf0","tags":["Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54351","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xjwm-4pfw-49g2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-54351","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-54351","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54351.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502749-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1247519","tags":["report"]},{"url":"https://bugzilla.suse.com/1247520","tags":["report"]},{"url":"https://bugzilla.suse.com/1247522","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54351","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-54351","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-54351","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-54351","description":"In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).","status":"published","published":"2025-08-03T00:00:00Z","modified":"2025-08-04T19:50:45.361Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T14:32:27.603809Z"}],"euvd":[{"id":"EUVD-2025-23458","description":"In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).","status":"published","published":"2025-08-03T00:00:00Z","modified":"2025-08-04T19:50:45Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T20:32:01.599514Z"}],"ghsa":[{"id":"GHSA-xjwm-4pfw-49g2","title":"In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in...","description":"In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).","status":"published","published":"2025-08-03T03:30:30Z","modified":"2025-08-03T03:30:30Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T15:03:10.193177Z"}],"nvd":[{"id":"CVE-2025-54351","description":"In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).","status":"published","published":"2025-08-03T02:15:37.38Z","modified":"2026-06-17T09:39:55.167Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T14:11:21.71471Z"}],"osv":[{"id":"ALPINE-CVE-2025-54351","description":"In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).","status":"published","published":"2025-08-03T02:15:37.38Z","modified":"2026-08-27T22:18:02.991652773Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-54351","status":"published","published":"2025-08-05T06:02:15.74942Z","modified":"2026-10-16T07:15:02.436565195Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-54351","description":"In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).","status":"published","published":"2025-08-03T00:00:00Z","modified":"2026-11-11T13:20:56.681152249Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-420"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"UBUNTU-CVE-2025-54351","description":"In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).","status":"published","published":"2025-08-03T02:15:00Z","modified":"2026-11-06T13:51:28.431904841Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T14:23:50.293009Z"},{"id":"openSUSE-SU-2025:15414-1","title":"iperf-3.19.1-1.1 on GA media","description":"These are all security issues fixed in the iperf-3.19.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-06T00:00:00Z","modified":"2026-03-23T04:53:44.853108Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:02749-1","title":"Security update for iperf","description":"This update for iperf fixes the following issues:\n\n- update to 3.19.1:\n  * CVE-2025-54351: Fixed buffer overflow in net.c (bsc#1247522)\n  * CVE-2025-54350: Fixed Base64Decode assertion failure and application \n    exit upon a malformed authentication attempt (bsc#1247520)\n  * CVE-2025-54349: Fixed off-by-one error and resultant heap-based \n    buffer overflow (bsc#1247519)\n\n- update to 3.19:\n  * iperf3 now supports the use of Multi-Path TCP (MPTCPv1) on Linux\n    with the use of the `-m` or `--mptcp` flag. (PR #1661)\n  * iperf3 now supports a `--cntl-ka` option to enable TCP keepalives\n    on the control connection. (#812, #835, PR #1423)\n  * iperf3 now supports the `MSG_TRUNC` receive option, specified by\n    the `--skip-rx-copy`. This theoretically improves the rated\n    throughput of tests at high bitrates by not delivering network\n    payload data to userspace. (#1678, PR #1717)\n  * A bug that caused the bitrate setting to be ignored when bursts\n    are set, has been fixed. (#1773, #1820, PR #1821, PR #1848)\n  * The congestion control protocol setting, if used, is now\n    properly reset between tests. (PR #1812)\n  * iperf3 now exits with a non-error 0 exit code if exiting via a\n    `SIGTERM`, `SIGHUP`, or `SIGINT`. (#1009, PR# 1829)\n  * The current behavior of iperf3 with respect to the `-n` and `-k`\n    options is now documented as correct. (#1768, #1775, #596, PR #1800)\n","status":"published","published":"2025-08-11T07:06:39Z","modified":"2026-02-04T02:47:13.430435Z","updated_at":"2026-11-02T15:53:57.111474Z"}]}}