Vulnerability · Published Aug 11, 2026 · Assigned by redhat
CVE-2026-71217Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion
High 7.5
In plain English
A high-severity improper input validation in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | iperf3 | 3.17.1-6.el10_2.1 | ALSA-2026:61680 |
| AlmaLinux:8 | iperf3 | 3.5-12.el8_10.1 | ALSA-2026:61257 |
| AlmaLinux:9 | iperf3 | 3.9-17.el9_8.1 | ALSA-2026:61389 |
| Debian:12 | iperf3 | no fix listed | DEBIAN-CVE-2026-71217 |
| Debian:13 | iperf3 | no fix listed | DEBIAN-CVE-2026-71217 |
| Debian:14 | iperf3 | 3.22-0.1 | DEBIAN-CVE-2026-71217 |
| Rocky Linux:10 | iperf3 | 0:3.17.1-6.el10_2.1 | RLSA-2026:61680 |
| Rocky Linux:8 | iperf3 | 0:3.5-12.el8_10.1 | RLSA-2026:61257 |
| Rocky Linux:9 | iperf3 | 0:3.9-17.el9_8.1 | RLSA-2026:61389 |
| Ubuntu:26.04:LTS | iperf3 | no fix listed | UBUNTU-CVE-2026-71217 |
| Ubuntu:26.10 | iperf3 | no fix listed | UBUNTU-CVE-2026-71217 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2026:61257 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:61389 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:61680 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-71217 vdb-entry, x_refsource_REDHAT
- RHBZ#2460984 issue-tracking, x_refsource_REDHAT
- https://github.com/esnet/iperf/commit/494dd377eca4689672becdf06a85158557db1586