AlmaLinux 9.6 [TuxCare] Security Update: iperf3 / iperf3-devel (ALMALINUX9.6:CLSA-2026:1788821988)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788821988 advisory. - A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized numeri...

Rocky Linux 9 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource Multiple Vulnerabilities (crlsa-2024_9185)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249185 advisory. iperf3: possible denial of service CVE-2023-7250,ESNET-SECADV-2023-0002 iperf3: vulnerable to marvin attack if the authentication option is used...

Rocky Linux 8 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2025_0168)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20250168 advisory. iperf: Denial of Service in iperf Due to Improper JSON Handling CVE-2024-53580 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2026_1592)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20261592 advisory. iperf3: iperf Heap Buffer Overflow CVE-2025-54349 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus ha...

Rocky Linux 9 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2025_0161)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20250161 advisory. iperf: Denial of Service in iperf Due to Improper JSON Handling CVE-2024-53580 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9.2 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource / iperf3-devel Multiple Vulnerabilities (ciqsa-2026_0433)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260433 advisory. This advisory aggregates security fixes for the iperf3 SRPM in CIQ LTS 9.2. It addresses 4 CVEs: CVE-2023-38403, CVE-2023-7250, CVE-2024-26306,...

Linux Distros Unpatched Vulnerability : CVE-2026-101283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iperf3 3.203.21 esnet/iperf has a pre-auth heap buffer overflow in decryptrsamessage: a 256-byte RSA buffer is BIOread with the attacker-controlled ciphertext...

Rocky Linux 8 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource Multiple Vulnerabilities (crlsa-2024_4241)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20244241 advisory. iperf3: possible denial of service CVE-2023-7250 iperf3: vulnerable to marvin attack if the authentication option is used CVE-2024-26306 Tenable has...

Rocky Linux 9 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2026_61389)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202661389 advisory. iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion CVE-2026-71217 Tenable has...

Rocky Linux 8 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2026_61257)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202661257 advisory. iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion CVE-2026-71217 Tenable has...

Rocky Linux 8 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2023_4570)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20234570 advisory. iperf3: memory allocation hazard and crash CVE-2023-38403 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

DEBIAN-CVE-2026-101283

iperf3 3.20–3.21 esnet/iperf has a pre-auth heap buffer overflow in decryptrsamessage: a 256-byte RSA buffer is BIOread with the attacker-controlled ciphertext length guard warns only, so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22...

CVE-2026-101283

iperf3 3.20–3.21 esnet/iperf has a pre-auth heap buffer overflow in decryptrsamessage: a 256-byte RSA buffer is BIOread with the attacker-controlled ciphertext length guard warns only, so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22...

CVE-2026-101283

iperf3 3.20–3.21 esnet/iperf has a pre-auth heap buffer overflow in decryptrsamessage: a 256-byte RSA buffer is BIOread with the attacker-controlled ciphertext length guard warns only, so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22...

UBUNTU-CVE-2026-101283

iperf3 3.20–3.21 esnet/iperf has a pre-auth heap buffer overflow in decryptrsamessage: a 256-byte RSA buffer is BIOread with the attacker-controlled ciphertext length guard warns only, so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22...

CVE-2026-101283

The iperf3 network testing tool (versions 3.20–3.21 by esnet/iperf) is vulnerable to a pre-auth heap buffer overflow within the decrypt_rsa_message() function. The root cause is that a 256-byte RSA buffer is populated using BIO_read with an attacker-controlled ciphertext length; while a guard pro...

CVE-2026-101283

iperf3 3.20–3.21 esnet/iperf has a pre-auth heap buffer overflow in decryptrsamessage: a 256-byte RSA buffer is BIOread with the attacker-controlled ciphertext length guard warns only, so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22...

CVE-2026-101283

iperf3 3.20–3.21 esnet/iperf has a pre-auth heap buffer overflow in decryptrsamessage: a 256-byte RSA buffer is BIOread with the attacker-controlled ciphertext length guard warns only, so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22...

CVE-2026-101283

iperf3 3.20–3.21 esnet/iperf has a pre-auth heap buffer overflow in decryptrsamessage: a 256-byte RSA buffer is BIOread with the attacker-controlled ciphertext length guard warns only, so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22...

AZL-105492 CVE-2026-101276 affecting package iperf3 3.17.1-6

iperf3 3.21 esnet/iperf contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog servertimerproc frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperfstream; fixed in 3.22...