High
iperf3 — security advisory
A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.
- Products
- iperf3
- Affected versions
- 3.0.11-1, 3.0.11-1ubuntu0.1~esm1, 3.0.11-1ubuntu0.1~esm2, 3.1.3-1, 3.1.3-1ubuntu0.1~esm1, 3.14-1, 3.15-1, 3.16-1, 3.16-1build1, 3.16-1build2, 3.16-1ubuntu0.1~esm1, 3.18-2, 3.19.1-2, 3.20-2, 3.20-2.1, 3.20-2.1build1, 3.6-2, 3.7-1, 3.7-2, 3.7-3, 3.7-3ubuntu0.1~esm1, 3.7-3ubuntu0.1~esm2, 3.9-1, 3.9-1+deb11u1build0.22.04.1, 3.9-1+deb11u1ubuntu0.1, 3.9-1+deb11u1ubuntu0.1~esm1, 3.9-1build1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-71217
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:14 UTC · Revision 1
Source evidence
A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.
osv:UBUNTU-CVE-2026-71217
iperf3
Fixed versions: Not specified
iperf3
Fixed versions: Not specified
iperf3
Fixed versions: Not specified
iperf3
Fixed versions: Not specified
iperf3
Fixed versions: Not specified
iperf3
Fixed versions: Not specified
iperf3
Fixed versions: Not specified
Complete source record
{
"id": "a24f5da48f6c2f4e698ef339e70168ad6d3ce82b0c26b877bf68133fdad1f46a",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-71217",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-71217",
"summary": "A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.",
"evidence": "osv:UBUNTU-CVE-2026-71217",
"products": [
{
"name": {
"value": "iperf3",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.0.11-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.11-1ubuntu0.1~esm1",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.11-1ubuntu0.1~esm2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "iperf3",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.1.3-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.3-1ubuntu0.1~esm1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "iperf3",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.6-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.7-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.7-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.7-3",
"evidence": "/affected/2/versions"
},
{
"value": "3.7-3ubuntu0.1~esm1",
"evidence": "/affected/2/versions"
},
{
"value": "3.7-3ubuntu0.1~esm2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "iperf3",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.9-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.9-1build1",
"evidence": "/affected/3/versions"
},
{
"value": "3.9-1+deb11u1build0.22.04.1",
"evidence": "/affected/3/versions"
},
{
"value": "3.9-1+deb11u1ubuntu0.1~esm1",
"evidence": "/affected/3/versions"
},
{
"value": "3.9-1+deb11u1ubuntu0.1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "iperf3",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.14-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.15-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.16-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.16-1build1",
"evidence": "/affected/4/versions"
},
{
"value": "3.16-1build2",
"evidence": "/affected/4/versions"
},
{
"value": "3.16-1ubuntu0.1~esm1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "iperf3",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.20-2",
"evidence": "/affected/5/versions"
},
{
"value": "3.20-2.1",
"evidence": "/affected/5/versions"
},
{
"value": "3.20-2.1build1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "iperf3",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.18-2",
"evidence": "/affected/6/versions"
},
{
"value": "3.19.1-2",
"evidence": "/affected/6/versions"
},
{
"value": "3.20-2",
"evidence": "/affected/6/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-71217",
"aliases": [
"UBUNTU-CVE-2026-71217"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "iperf3",
"purl": "pkg:deb/ubuntu/iperf3?arch=source&distro=esm-apps%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"3.0.11-1",
"3.0.11-1ubuntu0.1~esm1",
"3.0.11-1ubuntu0.1~esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71217.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "iperf3",
"binary_version": "3.0.11-1ubuntu0.1~esm2"
},
{
"binary_name": "libiperf0",
"binary_version": "3.0.11-1ubuntu0.1~esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "iperf3",
"purl": "pkg:deb/ubuntu/iperf3?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"3.1.3-1",
"3.1.3-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71217.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "iperf3",
"binary_version": "3.1.3-1ubuntu0.1~esm1"
},
{
"binary_name": "libiperf0",
"binary_version": "3.1.3-1ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "iperf3",
"purl": "pkg:deb/ubuntu/iperf3?arch=source&distro=esm-apps%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"3.6-2",
"3.7-1",
"3.7-2",
"3.7-3",
"3.7-3ubuntu0.1~esm1",
"3.7-3ubuntu0.1~esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71217.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "iperf3",
"binary_version": "3.7-3ubuntu0.1~esm2"
},
{
"binary_name": "libiperf0",
"binary_version": "3.7-3ubuntu0.1~esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "iperf3",
"purl": "pkg:deb/ubuntu/iperf3?arch=source&distro=esm-apps%2Fjammy",
"ecosystem": "Ubuntu:Pro:22.04:LTS"
},
"versions": [
"3.9-1",
"3.9-1build1",
"3.9-1+deb11u1build0.22.04.1",
"3.9-1+deb11u1ubuntu0.1~esm1",
"3.9-1+deb11u1ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71217.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "iperf3",
"binary_version": "3.9-1+deb11u1ubuntu0.1"
},
{
"binary_name": "libiperf0",
"binary_version": "3.9-1+deb11u1ubuntu0.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "iperf3",
"purl": "pkg:deb/ubuntu/iperf3?arch=source&distro=esm-apps%2Fnoble",
"ecosystem": "Ubuntu:Pro:24.04:LTS"
},
"versions": [
"3.14-1",
"3.15-1",
"3.16-1",
"3.16-1build1",
"3.16-1build2",
"3.16-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71217.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "iperf3",
"binary_version": "3.16-1ubuntu0.1~esm1"
},
{
"binary_name": "libiperf0",
"binary_version": "3.16-1ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "iperf3",
"purl": "pkg:deb/ubuntu/iperf3?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"3.20-2",
"3.20-2.1",
"3.20-2.1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71217.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "iperf3",
"binary_version": "3.20-2.1build1"
},
{
"binary_name": "libiperf0",
"binary_version": "3.20-2.1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "iperf3",
"purl": "pkg:deb/ubuntu/iperf3?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"3.18-2",
"3.19.1-2",
"3.20-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71217.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "iperf3",
"binary_version": "3.20-2"
},
{
"binary_name": "libiperf0",
"binary_version": "3.20-2"
}
]
}
}
],
"modified": "2026-10-17T13:00:45.113887419Z",
"provider": "osv",
"upstream": [
"CVE-2026-71217"
],
"references": [
"https://ubuntu.com/security/CVE-2026-71217",
"https://www.cve.org/CVERecord?id=CVE-2026-71217",
"https://bugzilla.redhat.com/show_bug.cgi?id=2460984",
"https://github.com/esnet/iperf/commit/494dd377eca4689672becdf06a85158557db1586",
"https://access.redhat.com/security/cve/CVE-2026-71217"
]
},
"related_cves": [
{
"value": "CVE-2026-71217",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 360814,
"published_at": "2026-08-11T09:17:00+00:00"
}