Iperf3
Monthly
Heap-based buffer overflow in iperf3 3.20 and 3.21 allows an unauthenticated remote client to overrun a 256-byte RSA buffer inside decrypt_rsa_message() by sending an oversized authtoken, corrupting heap memory on the server and potentially achieving remote code execution or a crash (CWE-122). The flaw is only reachable when an operator has explicitly started the iperf3 server in RSA-authentication mode with --rsa-private-key-path and --authorized-users-path; default iperf3 servers run without authentication and never enter the vulnerable code path, which is reflected in the upstream CVSS 4.0 vector's AT:P (attack requirements present) and in our independent assessment of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied; a vendor fix is released as iperf3 3.22.
Remote unauthenticated heap use-after-free in iperf3 3.21 can let an attacker crash or potentially execute code on an exposed iperf3 server. The flaw occurs in server mode when the per-test watchdog frees an iperf_stream without joining the worker thread, and a blocked worker then dereferences the freed memory; exploitation requires winning a timing race (AT:P), so success is not guaranteed on a single attempt. No public exploit identified at time of analysis; the vendor fix is iperf3 3.22.
Denial of service in iperf3 prior to 3.22 allows unauthenticated remote attackers to permanently pin a UDP receive worker thread at approximately 100% CPU by sending a crafted control-channel parameter message followed by a single 16-byte UDP datagram. The affected server becomes unresponsive and does not respond to normal control-channel closure, requiring SIGKILL to terminate. Exploitation requires a network-reachable iperf3 server in server mode with a UDP test path; the vendor has released patch 3.22, and no public exploit identified at time of analysis.
In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv). Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required.
In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.
In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required.
iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Heap-based buffer overflow in iperf3 3.20 and 3.21 allows an unauthenticated remote client to overrun a 256-byte RSA buffer inside decrypt_rsa_message() by sending an oversized authtoken, corrupting heap memory on the server and potentially achieving remote code execution or a crash (CWE-122). The flaw is only reachable when an operator has explicitly started the iperf3 server in RSA-authentication mode with --rsa-private-key-path and --authorized-users-path; default iperf3 servers run without authentication and never enter the vulnerable code path, which is reflected in the upstream CVSS 4.0 vector's AT:P (attack requirements present) and in our independent assessment of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied; a vendor fix is released as iperf3 3.22.
Remote unauthenticated heap use-after-free in iperf3 3.21 can let an attacker crash or potentially execute code on an exposed iperf3 server. The flaw occurs in server mode when the per-test watchdog frees an iperf_stream without joining the worker thread, and a blocked worker then dereferences the freed memory; exploitation requires winning a timing race (AT:P), so success is not guaranteed on a single attempt. No public exploit identified at time of analysis; the vendor fix is iperf3 3.22.
Denial of service in iperf3 prior to 3.22 allows unauthenticated remote attackers to permanently pin a UDP receive worker thread at approximately 100% CPU by sending a crafted control-channel parameter message followed by a single 16-byte UDP datagram. The affected server becomes unresponsive and does not respond to normal control-channel closure, requiring SIGKILL to terminate. Exploitation requires a network-reachable iperf3 server in server mode with a UDP test path; the vendor has released patch 3.22, and no public exploit identified at time of analysis.
In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv). Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required.
In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.
In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required.
iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.