In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow.
Priority MEDIUM 43CWE-193Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-193 and the CVSS impact.
Summary
In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00468 40th percentileScored 2026-11-07
Fix Fixed iperf3 (ES): 3.19.1Red Hat: 12 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA iperf3 (ES) Fixed in 3.19.1
Red Hat 12 advisories
- RHSA-2026:2449 Released 2026-02-10 · Red Hat rating Moderateiperf3 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) iperf3-3.5-7.el8_6.2
- Red Hat Enterprise Linux AppStream E4S (v.8.6) iperf3-3.5-7.el8_6.2
- Red Hat Enterprise Linux AppStream TUS (v.8.6) iperf3-3.5-7.el8_6.2
- RHSA-2026:2448 Released 2026-02-10 · Red Hat rating Moderateiperf3 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) iperf3-3.5-7.el8_4.2
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) iperf3-3.5-7.el8_4.2
- RHSA-2026:2328 Released 2026-02-09 · Red Hat rating Moderateiperf3 security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) iperf3-3.5-7.el8_8.2
- Red Hat Enterprise Linux AppStream TUS (v.8.8) iperf3-3.5-7.el8_8.2
Show 9 more Red Hat advisories
- RHSA-2026:2329 Released 2026-02-09 · Red Hat rating Moderateiperf3 security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) iperf3-3.5-4.el8_2.2
- RHSA-2026:1967 Released 2026-02-04 · Red Hat rating Moderateiperf3 security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) iperf3-3.17.1-4.el10_0.1
- RHSA-2026:1882 Released 2026-02-04 · Red Hat rating Moderateiperf3 security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) iperf3-3.9-10.el9_2.2
- RHSA-2026:1881 Released 2026-02-04 · Red Hat rating Moderateiperf3 security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) iperf3-3.9-10.el9_0.2
- RHSA-2026:1773 Released 2026-02-03 · Red Hat rating Moderateiperf3 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) iperf3-3.9-11.el9_4.2
- RHSA-2026:1760 Released 2026-02-02 · Red Hat rating Moderateiperf3 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) iperf3-3.9-14.el9_6.1
- RHSA-2026:1597 Released 2026-01-29 · Red Hat rating Moderateiperf3 security update
- Red Hat Enterprise Linux AppStream (v. 10) iperf3-3.17.1-5.el10_1
- RHSA-2026:1595 Released 2026-01-29 · Red Hat rating Moderateiperf3 security update
- Red Hat Enterprise Linux AppStream (v. 9) iperf3-3.9-14.el9_7.1
- RHSA-2026:1592 Released 2026-01-29 · Red Hat rating Moderateiperf3 security update
- Red Hat Enterprise Linux AppStream (v. 8) iperf3-3.5-12.el8_10
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
ES iperf3 3.19.1
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-34173 In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).Priority MEDIUM 43
- TI-2025-34172 Reachable assertion in ES iperf3Priority LOW 25
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:1597 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:1592 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:1595 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2026:2329 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2026:2448 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:2449 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2026:2449 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:2328 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2026:1881 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:1882 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:1967 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2026:1773 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:1760 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:2448 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2026:2449 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:2328 |
Not affected: 1 product
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2025-54349
- 2026-10-03 Alias added: GHSA-8xx8-qrh3-q8mq
References
More ES Iperf3 vulnerabilities
- TI-2024-35847 iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function. CVSS 3.1HIGH 7.5
- TI-2016-03690 The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings… CVSS 3.1CRITICAL 9.8
- TI-2025-34173 In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv). CVSS 3.1CRITICAL 10.0
- TI-2023-19787 iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. CVSS 3.1HIGH 7.5
- TI-2024-17387 iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA… CVSS 3.1MEDIUM 5.9
- TI-2023-06634 Iperf3: possible denial of service CVSS 3.1MEDIUM 5.3
Sources
- CVE-2025-54349 · CVE Program
- CVE-2025-54349 · NVD
- FIRST EPSS
- GHSA-8xx8-qrh3-q8mq · GitHub Advisory Database · CC BY 4.0
- CVE-2025-54349 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences