MediumFix available
iperf3 — security advisory
A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.
- Products
- iperf3
- Affected versions
- 3.12-1, 3.12-1+deb12u1, 3.12-1+deb12u2, 3.13-1, 3.13-2, 3.14-1, 3.15-1, 3.16-1, 3.17.1-1, 3.18-1, 3.18-2, 3.19.1-1, 3.19.1-2, 3.20-1, 3.20-2, 3.20-2.1, 3.22-0.1
- Fixed versions
- 3.15-1
- CVEs
- CVE-2023-7250
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 16:21 UTC · Revision 1
Source evidence
A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.
osv:DEBIAN-CVE-2023-7250
iperf3
Fixed versions: Not specified
iperf3
Fixed versions: 3.15-1
iperf3
Fixed versions: 3.15-1
Complete source record
{
"id": "e66fce232ada7ea4be6b37d57829dfcfd70c6ba10b9875fb1fb44cb2cb33a69e",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2023-7250",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2023-7250",
"summary": "A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.",
"evidence": "osv:DEBIAN-CVE-2023-7250",
"products": [
{
"name": {
"value": "iperf3",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.12-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.12-1+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "3.12-1+deb12u2",
"evidence": "/affected/0/versions"
},
{
"value": "3.13-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.13-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.14-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.15-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.16-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.17.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.18-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.18-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.19.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.19.1-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.20-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.20-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.20-2.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.22-0.1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "iperf3",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.15-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "iperf3",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.15-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2023-7250",
"aliases": [
"DEBIAN-CVE-2023-7250"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "iperf3",
"purl": "pkg:deb/debian/iperf3?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.12-1",
"3.12-1+deb12u1",
"3.12-1+deb12u2",
"3.13-1",
"3.13-2",
"3.14-1",
"3.15-1",
"3.16-1",
"3.17.1-1",
"3.18-1",
"3.18-2",
"3.19.1-1",
"3.19.1-2",
"3.20-1",
"3.20-2",
"3.20-2.1",
"3.22-0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-7250.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.15-1"
}
]
}
],
"package": {
"name": "iperf3",
"purl": "pkg:deb/debian/iperf3?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-7250.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.15-1"
}
]
}
],
"package": {
"name": "iperf3",
"purl": "pkg:deb/debian/iperf3?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-7250.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T18:03:02.625812071Z",
"provider": "osv",
"upstream": [
"CVE-2023-7250"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2023-7250"
]
},
"related_cves": [
{
"value": "CVE-2023-7250",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 457485,
"published_at": "2024-03-18T13:15:06.91+00:00"
}