Vulnerability · Published Sep 30, 2026 · Assigned by Anthropic

CVE-2026-101283

Critical 9.2

In plain English

A critical-severity heap buffer overflow in iperf3 from esnet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.4%top 67.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	iperf3	no fix listed	DEBIAN-CVE-2026-101283
Debian:14	iperf3	3.22-0.1	DEBIAN-CVE-2026-101283
Ubuntu:26.04:LTS	iperf3	no fix listed	UBUNTU-CVE-2026-101283
Ubuntu:26.10	iperf3	no fix listed	UBUNTU-CVE-2026-101283

Affected products (as reported)

Vendor	Product	Versions
esnet	iperf3	3.203.21

Weakness: CWE-122 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://newreleases.io/project/github/esnet/iperf/release/3.22