Your message dated Fri, 02 Oct 2026 13:21:05 +0000
with message-id <[email protected]>
and subject line Bug#1149699: fixed in iperf3 3.22-0.1
has caused the Debian Bug report #1149699,
regarding iperf3: CVE-2026-101276 CVE-2026-101283 CVE-2026-102253
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149699: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149699
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: iperf3
Version: 3.20-2.1
X-Debbugs-CC: [email protected]
Severity: important
Tags: upstream security
Hi,
The following vulnerabilities were published for iperf3.
CVE-2026-101276[0]:
| iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap
| use-after-free: the server's per-test watchdog server_timer_proc()
| frees streams without cancelling/joining their worker threads, so a
| blocked worker dereferences a freed iperf_stream; fixed in 3.22.
CVE-2026-101283[1]:
| iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow
| in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the
| attacker-controlled ciphertext length (guard warns only), so an
| unauthenticated client overflows the heap via an oversized
| authtoken; fixed in 3.22
CVE-2026-102253[2]:
| iperf3 versions prior to 3.22 contains a denial of service
| vulnerability that allows unauthenticated remote attackers to crash-
| loop the server's UDP receive worker into an unrecoverable infinite
| loop by sending a single crafted control-channel parameter message
| followed by one 16-byte UDP datagram. Attackers can permanently pin
| the affected per-stream receive thread at approximately 100% CPU
| usage, rendering the server unusable until forcibly killed with
| SIGKILL, as the process does not respond to normal control-channel
| closure.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-101276
https://www.cve.org/CVERecord?id=CVE-2026-101276
[1] https://security-tracker.debian.org/tracker/CVE-2026-101283
https://www.cve.org/CVERecord?id=CVE-2026-101283
[2] https://security-tracker.debian.org/tracker/CVE-2026-102253
https://www.cve.org/CVERecord?id=CVE-2026-102253
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: iperf3
Source-Version: 3.22-0.1
Done: Daniel Baumann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
iperf3, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Daniel Baumann <[email protected]> (supplier of updated iperf3 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 02 Oct 2026 14:52:21 +0200
Source: iperf3
Architecture: source
Version: 3.22-0.1
Distribution: sid
Urgency: high
Maintainer: Roberto Lumbreras <[email protected]>
Changed-By: Daniel Baumann <[email protected]>
Closes: 1144390 1149699
Changes:
iperf3 (3.22-0.1) sid; urgency=high
.
* Non-maintainer upload.
* New upstream release (Closes: #1144390, #1149699), any operators of public
iperf3 servers are strongly recommended to upgrade:
- iperf3 server accepts unbounded peer-controlled json parameters enabling
remote denial of service via resource exhaustion [CVE-2026-71217].
- iperf3 contains a remote, unauthenticated heap use-after-free: the
server's per-test watchdog server_timer_proc() frees streams without
cancelling/joining their worker threads, so a blocked worker
dereferences a freed iperf_stream [CVE-2026-101276].
- iperf3 has a pre-auth heap buffer overflow in decrypt_rsa_message(): a
256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext
length (guard warns only), so an unauthenticated client overflows the
heap via an oversized authtoken [CVE-2026-101283].
- iperf3 contains a denial of service ulnerability that allows
unauthenticated remote attackers to crash-loop the server's UDP receive
worker into an unrecoverable infinite loop by sending a single crafted
control-channel parameter message followed by one 16-byte UDP datagram.
Attackers can permanently pin the affected per-stream receive thread at
approximately 100% CPU usage, rendering the server unusable until
forcibly killed with SIGKILL, as the process does not respond to normal
control-channel closure [CVE-2026-102253].
* Updating libiperf0 symbols for new upstream release.
Checksums-Sha1:
9c6a812984b14d6d3274da09c3b18e35e6a1dad5 1353 iperf3_3.22-0.1.dsc
e73f18745e00b863d6d77be75bfbfc90b7521281 638780 iperf3_3.22.orig.tar.xz
09d021ada2b60b9e0d2abb976f82fbaade4f852e 17108 iperf3_3.22-0.1.debian.tar.xz
8311b947ea3893b533348559f88735e5c752b3cd 6171 iperf3_3.22-0.1_amd64.buildinfo
Checksums-Sha256:
3ec85260cae75426c0a72e93fd2d24c7351bdea5120f86815ab63f15a9bec207 1353
iperf3_3.22-0.1.dsc
88ece405c56e70d1504e220b5ae3805bd1aaed40efd160e83a49a9aa0d734c45 638780
iperf3_3.22.orig.tar.xz
4501e4c42e93f8811e5ba6594ad82318e2fccb240ac0bd1ed9987fb653bb77d2 17108
iperf3_3.22-0.1.debian.tar.xz
069aa296167ccd4c2b2553a8710c6135769d74c6c986d6831b1c861644cbfaa2 6171
iperf3_3.22-0.1_amd64.buildinfo
Files:
cc4a657b03c6f96c85aceb974781c54e 1353 net optional iperf3_3.22-0.1.dsc
f572295b83d81879416b7727b080c0ab 638780 net optional iperf3_3.22.orig.tar.xz
85159810f3593973fde1afefef39a894 17108 net optional
iperf3_3.22-0.1.debian.tar.xz
b2e2f8d63d847e88d117ff6f46158ceb 6171 net optional
iperf3_3.22-0.1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQQmmGg4gLaoSj0ERgL7tPDoCoAiLwUCar+rfAAKCRD7tPDoCoAi
L5VUAP9HQVwEYGgsz2Pqsko2N706AFK1hm+8tkatxnZFqLrm+AEA9rxiPTFcS0ce
D+4e4a8sIw31P27ShGnYc1wRqCrSIgQ=
=8fji
-----END PGP SIGNATURE-----
pgpTEw7VdSEuX.pgp
Description: PGP signature
--- End Message ---
