{"id":"CVE-2026-101283","aliases":["BELL-CVE-2026-101283","DEBIAN-CVE-2026-101283","EUVD-2026-90389","GHSA-pwcx-5qh6-2pxc","MGASA-2026-0539","SUSE-SU-2026:24178-1","SUSE-SU-2026:24234-1","SUSE-SU-2026:4678-1","UBUNTU-CVE-2026-101283","openSUSE-SU-2026:12060-1","openSUSE-SU-2026:22090-1"],"status":"published","title":"iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a...","description":"iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00383,"percentile":0.32609,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-09-30T21:32:14Z","modified":"2026-11-05T11:45:16Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"iperf3","fixed_in":["3.22-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"iperf3","fixed_in":["3.22-0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12-r0"},{"fixed":"3.22-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.18-2","3.18-2+deb13u1","3.18-2+deb13u2","3.19.1-1","3.19.1-2","3.20-1","3.20-2","3.20-2.1","3.22-0.1"]},{"source":"osv","ecosystem":"Debian:14","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-0.1"}]}],"versions":["3.18-2","3.19.1-1","3.19.1-2","3.20-1","3.20-2","3.20-2.1"]},{"source":"osv","ecosystem":"Mageia:10","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-1.mga10"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-150000.3.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-150000.3.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.11-1","3.0.11-1ubuntu0.1~esm1","3.0.11-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.3-1","3.1.3-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6-2","3.7-1","3.7-2","3.7-3","3.7-3ubuntu0.1~esm1","3.7-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14-1","3.15-1","3.16-1","3.16-1build1","3.16-1build2","3.16-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20-2","3.20-2.1","3.20-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.18-2","3.19.1-2","3.20-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21-160000.1.1"}]}],"bundled":5}],"products":[{"vendor":"es","product":"iperf3"},{"vendor":"esnet","product":"iperf3"}],"references":[{"url":"https://newreleases.io/project/github/esnet/iperf/release/3.22","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101283"},{"url":"https://github.com/advisories/GHSA-pwcx-5qh6-2pxc"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-101283","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-101283","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0539.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36548","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WVURYNW7KMOY3RQC6OJUZLHYUU5HP4Y3/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624178-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283528","tags":["report"]},{"url":"https://bugzilla.suse.com/1283786","tags":["report"]},{"url":"https://bugzilla.suse.com/1283787","tags":["report"]},{"url":"https://bugzilla.suse.com/1284404","tags":["report"]},{"url":"https://bugzilla.suse.com/1284405","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-101276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-101283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71218","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624234-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264678-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-101283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101283","tags":["report"]},{"url":"https://github.com/esnet/iperf/releases/tag/3.22","tags":["report"]},{"url":"https://github.com/esnet/iperf/commit/e29f6504dcfac7d2961fed4fd66364115e36fe5a","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-101283","description":"iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22","status":"published","published":"2026-09-30T21:32:14.699Z","modified":"2026-10-01T15:51:37.669Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:20:09.448255Z"}],"euvd":[{"id":"EUVD-2026-90389","description":"iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22","status":"published","published":"2026-09-30T21:32:14Z","modified":"2026-10-01T15:51:37Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T17:27:44.672309Z"}],"ghsa":[{"id":"GHSA-pwcx-5qh6-2pxc","title":"iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a...","description":"iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22","status":"published","published":"2026-10-01T00:32:49Z","modified":"2026-10-01T00:32:50Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:12:39.341866Z"}],"nvd":[{"id":"CVE-2026-101283","description":"iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22","status":"published","published":"2026-09-30T22:16:33.317Z","modified":"2026-10-01T16:17:32.46Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:53.097633Z"}],"osv":[{"id":"DEBIAN-CVE-2026-101283","description":"iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22","status":"published","published":"2026-09-30T22:16:33.317Z","modified":"2026-10-05T11:00:06.271769065Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"UBUNTU-CVE-2026-101283","description":"iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22","status":"published","published":"2026-09-30T22:16:00Z","modified":"2026-11-05T11:45:16.285129751Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"BELL-CVE-2026-101283","status":"published","published":"2026-10-05T06:06:22.200289Z","modified":"2026-10-13T07:15:02.027418226Z","updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"MGASA-2026-0539","title":"Updated iperf package fixes security vulnerabilities","description":"Iperf3 server accepts unbounded peer-controlled json parameters enabling\nremote denial of service via resource exhaustion. (CVE-2026-71217)\nUnbounded peer-controlled allocation in iperf3 json_read() allows\nunauthenticated remote memory exhaustion. (CVE-2026-71218)\nIperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap\nuse-after-free: the server's per-test watchdog server_timer_proc() frees\nstreams without cancelling/joining their worker threads, so a blocked\nworker dereferences a freed iperf_stream. (CVE-2026-101276)\nIperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in\ndecrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the\nattacker-controlled ciphertext length (guard warns only), so an\nunauthenticated client overflows the heap via an oversized authtoken.\n(CVE-2026-101283)\nIperf3 \u003c 3.22 UDP Receive Worker Infinite Loop DoS. (CVE-2026-102253)\n","status":"published","published":"2026-10-25T01:13:22Z","modified":"2026-10-25T01:28:09.754940198Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12060-1","title":"iperf-3.22-1.1 on GA media","description":"These are all security issues fixed in the iperf-3.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-05T00:00:00Z","modified":"2026-10-06T17:23:10.884795572Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22090-1","title":"Security update for iperf","description":"This update for iperf fixes the following issues:\n\n- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via\n  resource exhaustion (bsc#1284405).\n- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion\n  (bsc#1284404).\n- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-\n  test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).\n- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a\n  256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).\n- CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an\n  infinite loop (bsc#1283528).\n\nChanges for iperf:\n\n- Updated to version 3.22\n","status":"published","published":"2026-10-12T12:12:10Z","modified":"2026-10-19T17:23:13.585480674Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24178-1","title":"Security update for iperf","description":"This update for iperf fixes the following issues:\n\n- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via\n  resource exhaustion (bsc#1284405).\n- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion\n  (bsc#1284404).\n- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-\n  test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).\n- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a\n  256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).\n- CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an\n  infinite loop (bsc#1283528).\n\nChanges for iperf:\n\n- Updated to version 3.22\n","status":"published","published":"2026-10-12T12:14:05Z","modified":"2026-10-20T17:23:58.074616255Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24234-1","title":"Security update for iperf","description":"This update for iperf fixes the following issues:\n\n- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via\n  resource exhaustion (bsc#1284405).\n- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion\n  (bsc#1284404).\n- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-\n  test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).\n- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a\n  256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).\n- CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an\n  infinite loop (bsc#1283528).\n\nChanges for iperf:\n\n- Updated to version 3.22\n","status":"published","published":"2026-10-12T12:09:00Z","modified":"2026-10-21T17:23:11.546296457Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4678-1","title":"Security update for iperf","description":"This update for iperf fixes the following issues:\n\n- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via\n  resource exhaustion (bsc#1284405).\n- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion\n  (bsc#1284404).\n- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-\n  test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).\n- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a\n  256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).\n- CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an\n  infinite loop (bsc#1283528).\n\nChanges for iperf:\n\n- Updated to version 3.22.\n","status":"published","published":"2026-10-15T07:27:34Z","modified":"2026-10-15T18:00:06.423872963Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}