EUVD-2026-55991
GHSA-8m2w-v7g5-76v3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Service termination from memory exhaustion warrants A:H over A:L; all other metrics match the unauthenticated, low-complexity remote attack with no scope change.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the JSON_read() function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.
AnalysisAI
Uncontrolled memory allocation in iperf3's JSON_read() function exposes any network-reachable iperf3 server to remote unauthenticated denial of service. The function accepts a peer-supplied message length and allocates memory against that value without imposing an upper bound, enabling an attacker to exhaust host memory and cause the iperf3 process to hang, slow severely, or terminate. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at time of analysis.
Technical ContextAI
iperf3 is an open-source network bandwidth measurement tool that exchanges control messages between client and server using a JSON-based protocol. The JSON_read() function is responsible for receiving these messages; it reads a peer-supplied length value and uses it directly to drive a memory allocation without applying any maximum bound. This is a textbook CWE-789 (Uncontrolled Memory Allocation) pattern: untrusted external input - here a single integer field in the JSON handshake - directly controls the size of an allocation, allowing resource exhaustion proportional to whatever value the attacker chooses to supply. Because iperf3 in server mode must accept connections from client peers to function, there is no protocol-level gate preventing an attacker from reaching this code path before any test logic executes.
Affected ProductsAI
iperf3 is affected through its JSON_read() function. The Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-71218 and the associated Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2463003 document the issue, but specific affected version ranges and CPE strings were not enumerated in the available intelligence. Affected version ranges should be confirmed directly via the Red Hat advisory and the upstream iperf3 project changelog.
RemediationAI
No specific patched version number was identified in the available intelligence data. The Red Hat CVE advisory at https://access.redhat.com/security/cve/CVE-2026-71218 and Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2463003 should be monitored for patch releases and applied as soon as a fix version is confirmed. As an immediate compensating control, restrict access to the iperf3 listening port (default TCP 5201) via host firewall rules or network ACLs to permit connections only from known, trusted client IP addresses - this directly neutralizes the unauthenticated remote attack surface without requiring a code change, though it will prevent ad-hoc testing from arbitrary locations. A second option is to run iperf3 only on demand rather than as a persistent background service, eliminating the standing exposure window; this trades operational convenience for reduced risk.
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today