Read the docs
TI-2026-65296 Aliases CVE-2026-102253GHSA-jhpr-vprv-wh8f

iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

Priority MEDIUM 44CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-835.

Summary

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00431 37th percentileScored 2026-11-07
Fix Fixed iperf3 (esnet): 3.22Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
esnetiperf33.14 to before 3.223.22Patch availableCNA
  • iperf3 Vendoresnet Affected 3.14 to before 3.22 Fixed in 3.22 Patch available CNA

Remediation

  • Fix · CNA iperf3 (esnet) Fixed in 3.22

Red Hat 1 advisory

  • RHSA-2026:88207 Released 2026-10-22 · Red Hat rating Important
    iperf3 security update
    • Red Hat Enterprise Linux AppStream (v. 10) iperf3-3.17.1-6.el10_2.2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:88207
Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-102253
  2. 2026-10-03 Alias added: GHSA-jhpr-vprv-wh8f
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-21 Affected versions changed · Red Hat
  5. 2026-10-23 Fix available: RHSA-2026:88207 · Red Hat
  6. 2026-10-23 Fix available: Red Hat Enterprise Linux AppStream (v. 10) · Red Hat

References

Patch 1

Other 1

  • TI-2026-65176 Heap-based buffer overflow in esnet iperf3 CVSS 4.0CRITICAL 9.2
  • TI-2026-65170 Use after free in esnet iperf3 CVSS 4.0CRITICAL 9.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences