Source: iperf3 Version: 3.20-2.1 X-Debbugs-CC: [email protected] Severity: important Tags: upstream security
Hi, The following vulnerabilities were published for iperf3. CVE-2026-101276[0]: | iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap | use-after-free: the server's per-test watchdog server_timer_proc() | frees streams without cancelling/joining their worker threads, so a | blocked worker dereferences a freed iperf_stream; fixed in 3.22. CVE-2026-101283[1]: | iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow | in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the | attacker-controlled ciphertext length (guard warns only), so an | unauthenticated client overflows the heap via an oversized | authtoken; fixed in 3.22 CVE-2026-102253[2]: | iperf3 versions prior to 3.22 contains a denial of service | vulnerability that allows unauthenticated remote attackers to crash- | loop the server's UDP receive worker into an unrecoverable infinite | loop by sending a single crafted control-channel parameter message | followed by one 16-byte UDP datagram. Attackers can permanently pin | the affected per-stream receive thread at approximately 100% CPU | usage, rendering the server unusable until forcibly killed with | SIGKILL, as the process does not respond to normal control-channel | closure. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-101276 https://www.cve.org/CVERecord?id=CVE-2026-101276 [1] https://security-tracker.debian.org/tracker/CVE-2026-101283 https://www.cve.org/CVERecord?id=CVE-2026-101283 [2] https://security-tracker.debian.org/tracker/CVE-2026-102253 https://www.cve.org/CVERecord?id=CVE-2026-102253 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
