What is the CVSS score of CVE-2026-71217?

CVE-2026-71217 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of iperf3 are affected by CVE-2026-71217?

iperf3 in server mode is vulnerable to unauthenticated Denial of Service attacks through resource exhaustion (CVE-2026-71217, CVSS 7.5); no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-71217?

Within 24 hours, inventory all systems running iperf3 in server mode and document their role in operational networks. Within 7 days, restrict iperf3 server network access to trusted internal networks only via firewall rules, deploy process-level resource monitoring (thread count, memory usage) with alerts for exhaustion patterns, and document baseline resource consumption. Within 30 days, monitor the iperf3 project repository for security patch releases and evaluate alternative network performance measurement tools (such as netperf or comparable solutions) if network-only protections prove insufficient.

iperf3 CVE-2026-71217

EUVD-2026-55990 HIGH

Improper Input Validation (CWE-20)

2026-08-11 secalert@redhat.com

GHSA-4jvc-h3x3-w6qj

Denial Of Service Suse

7.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated JSON submission, low complexity, causes full availability loss with no confidentiality or integrity impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 09:37 vuln.today

CVE Published

Aug 11, 2026 - 09:17 nvd

HIGH 7.5

DescriptionCVE.org

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.

AnalysisAI

Resource exhaustion in iperf3 server mode allows unauthenticated remote attackers to trigger a Denial of Service by submitting crafted control-channel JSON with oversized numeric values for the parallel and len parameters. The server performs no bounds validation on these fields, causing it to spawn excessive threads or streams and allocate disproportionately large buffers until system resources are exhausted. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.

Technical ContextAI

iperf3 is an open-source network bandwidth measurement tool that uses a TCP control channel (default port 5201) over which test configuration is exchanged as JSON-encoded messages before a test begins. The vulnerability is rooted in CWE-20 (Improper Input Validation): the server parses client-supplied JSON fields - specifically parallel (controlling the number of simultaneous streams/threads) and len (controlling the per-stream buffer size) - without enforcing any upper bound on their values. Excessively large values cause the server to attempt resource allocation (thread creation, memory allocation) proportional to attacker-controlled inputs, a classic unbounded resource consumption pattern. CPE strings for exact affected versions were not provided in the input data; affected version ranges should be confirmed via the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71217.

Affected ProductsAI

The affected product is iperf3, a widely-used open-source network throughput testing tool. The vulnerability is tracked by Red Hat under CVE-2026-71217 (https://access.redhat.com/security/cve/CVE-2026-71217) and documented in Red Hat Bugzilla issue #2460984 (https://bugzilla.redhat.com/show_bug.cgi?id=2460984). Specific affected version ranges and CPE strings were not included in the available input data; operators should consult the Red Hat advisory and the upstream iperf3 project release notes to determine which versions are vulnerable.

RemediationAI

The primary remediation is to upgrade to a patched version of iperf3 once released; no specific fix version number is confirmed in the available data - monitor https://access.redhat.com/security/cve/CVE-2026-71217 and the upstream iperf3 GitHub repository for patch announcements. As a pre-patch compensating control, restrict access to the iperf3 control port (TCP 5201 by default) using host-based or network firewall rules to allow only trusted IP ranges; this is the most effective mitigation since iperf3 has no built-in authentication mechanism. Operators should avoid running iperf3 in persistent server mode (iperf3 -s) on any interface exposed to untrusted networks; if cross-network testing is required, tunnel the connection over SSH or a VPN to enforce authentication at the transport layer. Note that firewall-based restrictions reduce exposure but do not eliminate risk from lateral movement by an attacker already inside a trusted network segment.