iperf3 CVE-2026-102253

Requires an iperf3 instance running in server mode (iperf3 -s) that is network-reachable by the attacker, and a UDP test path: the attacker first sends a crafted control-channel parameter message to set up the UDP stream, then a single 16-byte UDP datagram triggers the infinite loop in that stream's receive worker. No authentication, no user interaction, and no non-default configuration beyond simply having the server listening are needed - server mode plus reachability are the only prerequisites. The practical limiter is deployment posture: iperf3 servers are usually run transiently for testing rather than exposed persistently, so a durably reachable target is the main precondition for real-world abuse.

This is a genuine, easily-triggered denial-of-service issue but not a code-execution threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, VC:N/VI:N) is internally consistent with the description: a network-reachable, unauthenticated attacker with no user interaction and low complexity can crash-loop the UDP receive worker, yielding a high availability impact and zero confidentiality/integrity impact - a pure availability bug (CWE-835 infinite loop). The 8.7 base score is availability-only and should not be read as critical compromise. No EPSS score, no CISA KEV entry, and no public exploit code are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis' - though the trigger is trivially described (one crafted control message plus one 16-byte UDP datagram), meaning weaponization is low-effort should details circulate. The most important real-world mitigating factor is not in the CVSS vector: iperf3 is a diagnostic/benchmarking tool, so a persistently-exposed iperf3 server is far less common than the ubiquitous install base would suggest, which lowers practical attack surface. Net: a real, low-effort DoS worth patching promptly on any host running iperf3 in server mode reachable by untrusted networks, but a targeted-availability concern rather than a mass-exploitation emergency.

An attacker who can reach an internet- or LAN-exposed iperf3 server (running with the -s flag) sends a single crafted control-channel parameter message to negotiate a UDP test, then sends one specially-formed 16-byte UDP datagram. The affected per-stream receive thread enters an unrecoverable infinite loop pinned near 100% CPU and stops honoring control-channel closure, so the server stays wedged until an operator issues SIGKILL. No public exploit code is identified in the provided data, but the described trigger is simple enough to reproduce.