{"id":"CVE-2026-71218","aliases":["AZL-95598","BELL-CVE-2026-71218","DEBIAN-CVE-2026-71218","EUVD-2026-55991","GHSA-8m2w-v7g5-76v3","MGASA-2026-0539","SUSE-SU-2026:24178-1","SUSE-SU-2026:24234-1","SUSE-SU-2026:4678-1","UBUNTU-CVE-2026-71218","openSUSE-SU-2026:12060-1","openSUSE-SU-2026:22090-1"],"status":"published","title":"Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion","description":"A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00383,"percentile":0.3274,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-789"],"published":"2026-08-11T08:51:24Z","modified":"2026-11-06T10:04:46Z","fixes":[{"ecosystem":"Azure Linux:3","package":"iperf3","fixed_in":["3.17.1-5"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"iperf3","fixed_in":["3.22-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"iperf3","fixed_in":["3.18-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"iperf3","fixed_in":["3.18-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"iperf3","fixed_in":["3.18-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-5"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12-r0"},{"fixed":"3.22-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12-r0"},{"fixed":"3.18-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12-1","3.12-1+deb12u1","3.12-1+deb12u2","3.13-1","3.13-2","3.14-1","3.15-1","3.16-1","3.17.1-1","3.18-1","3.18-2","3.19.1-1","3.19.1-2","3.20-1","3.20-2","3.20-2.1","3.22-0.1"]},{"source":"osv","ecosystem":"Debian:13","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-1"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-1.mga10"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-150000.3.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-150000.3.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.11-1","3.0.11-1ubuntu0.1~esm1","3.0.11-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.3-1","3.1.3-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6-2","3.7-1","3.7-2","3.7-3","3.7-3ubuntu0.1~esm1","3.7-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9-1","3.9-1build1","3.9-1+deb11u1build0.22.04.1","3.9-1+deb11u1ubuntu0.1~esm1","3.9-1+deb11u1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14-1","3.15-1","3.16-1","3.16-1build1","3.16-1build2","3.16-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21-160000.1.1"}]}],"bundled":5}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-71218","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463003","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/esnet/iperf/commit/0128d0357b7e8916fe39e980e455729bc0e5fd4e","tags":["fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71218","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8m2w-v7g5-76v3"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-71218","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71218.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-71218","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0539.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36548","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WVURYNW7KMOY3RQC6OJUZLHYUU5HP4Y3/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624178-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283528","tags":["report"]},{"url":"https://bugzilla.suse.com/1283786","tags":["report"]},{"url":"https://bugzilla.suse.com/1283787","tags":["report"]},{"url":"https://bugzilla.suse.com/1284404","tags":["report"]},{"url":"https://bugzilla.suse.com/1284405","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-101276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-101283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71218","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624234-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264678-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-71218","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71218","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-71218","title":"Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion","description":"A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.","status":"published","published":"2026-08-11T08:51:24.805Z","modified":"2026-11-05T22:52:28.203Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-789"],"updated_at":"2026-11-05T23:55:29.66083Z"}],"euvd":[{"id":"EUVD-2026-55991","description":"A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.","status":"published","published":"2026-08-11T08:51:24Z","modified":"2026-11-05T22:52:28Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-06T00:02:32.983223Z"}],"ghsa":[{"id":"GHSA-8m2w-v7g5-76v3","title":"A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the ...","description":"A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.","status":"published","published":"2026-08-11T09:32:35Z","modified":"2026-08-11T12:30:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:10:17.025827Z"}],"nvd":[{"id":"CVE-2026-71218","description":"A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.","status":"published","published":"2026-08-11T09:17:14.2Z","modified":"2026-11-05T23:16:58.213Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-789"],"updated_at":"2026-11-06T01:57:39.389848Z"}],"osv":[{"id":"BELL-CVE-2026-71218","status":"published","published":"2026-08-12T06:04:25.766986Z","modified":"2026-10-16T07:15:02.447754635Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:25.50888Z"},{"id":"CVE-2026-71218","title":"Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion","description":"A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.","status":"published","published":"2026-08-11T08:51:24.805Z","modified":"2026-11-07T07:06:53.412392439Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-07T03:08:09.473992Z"},{"id":"DEBIAN-CVE-2026-71218","description":"A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.","status":"published","published":"2026-08-11T09:17:14.2Z","modified":"2026-11-06T10:04:46.72118723Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"UBUNTU-CVE-2026-71218","description":"A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.","status":"published","published":"2026-08-11T09:17:00Z","modified":"2026-08-19T11:09:40Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:57:03.035847Z"},{"id":"AZL-95598","title":"CVE-2026-71218 affecting package iperf3 for versions less than 3.17.1-5","description":"A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.","status":"published","published":"2026-08-11T09:17:14Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"MGASA-2026-0539","title":"Updated iperf package fixes security vulnerabilities","description":"Iperf3 server accepts unbounded peer-controlled json parameters enabling\nremote denial of service via resource exhaustion. (CVE-2026-71217)\nUnbounded peer-controlled allocation in iperf3 json_read() allows\nunauthenticated remote memory exhaustion. (CVE-2026-71218)\nIperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap\nuse-after-free: the server's per-test watchdog server_timer_proc() frees\nstreams without cancelling/joining their worker threads, so a blocked\nworker dereferences a freed iperf_stream. (CVE-2026-101276)\nIperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in\ndecrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the\nattacker-controlled ciphertext length (guard warns only), so an\nunauthenticated client overflows the heap via an oversized authtoken.\n(CVE-2026-101283)\nIperf3 \u003c 3.22 UDP Receive Worker Infinite Loop DoS. (CVE-2026-102253)\n","status":"published","published":"2026-10-25T01:13:22Z","modified":"2026-10-25T01:28:09.754940198Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12060-1","title":"iperf-3.22-1.1 on GA media","description":"These are all security issues fixed in the iperf-3.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-05T00:00:00Z","modified":"2026-10-06T17:23:10.884795572Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22090-1","title":"Security update for iperf","description":"This update for iperf fixes the following issues:\n\n- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via\n  resource exhaustion (bsc#1284405).\n- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion\n  (bsc#1284404).\n- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-\n  test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).\n- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a\n  256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).\n- CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an\n  infinite loop (bsc#1283528).\n\nChanges for iperf:\n\n- Updated to version 3.22\n","status":"published","published":"2026-10-12T12:12:10Z","modified":"2026-10-19T17:23:13.585480674Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24178-1","title":"Security update for iperf","description":"This update for iperf fixes the following issues:\n\n- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via\n  resource exhaustion (bsc#1284405).\n- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion\n  (bsc#1284404).\n- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-\n  test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).\n- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a\n  256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).\n- CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an\n  infinite loop (bsc#1283528).\n\nChanges for iperf:\n\n- Updated to version 3.22\n","status":"published","published":"2026-10-12T12:14:05Z","modified":"2026-10-20T17:23:58.074616255Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24234-1","title":"Security update for iperf","description":"This update for iperf fixes the following issues:\n\n- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via\n  resource exhaustion (bsc#1284405).\n- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion\n  (bsc#1284404).\n- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-\n  test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).\n- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a\n  256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).\n- CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an\n  infinite loop (bsc#1283528).\n\nChanges for iperf:\n\n- Updated to version 3.22\n","status":"published","published":"2026-10-12T12:09:00Z","modified":"2026-10-21T17:23:11.546296457Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4678-1","title":"Security update for iperf","description":"This update for iperf fixes the following issues:\n\n- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via\n  resource exhaustion (bsc#1284405).\n- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion\n  (bsc#1284404).\n- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-\n  test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).\n- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a\n  256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).\n- CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an\n  infinite loop (bsc#1283528).\n\nChanges for iperf:\n\n- Updated to version 3.22.\n","status":"published","published":"2026-10-15T07:27:34Z","modified":"2026-10-15T18:00:06.423872963Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}