Описание
Security update for iperf
This update for iperf fixes the following issues:
- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (bsc#1284405).
- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion (bsc#1284404).
- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per- test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).
- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).
- CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an infinite loop (bsc#1283528).
Changes for iperf:
- Updated to version 3.22.
Список пакетов
SUSE Enterprise Storage 7.1
SUSE Linux Enterprise Module for Package Hub 15 SP7
Ссылки
- Link for SUSE-SU-2026:4678-1
- E-Mail link for SUSE-SU-2026:4678-1
- SUSE Security Ratings
- SUSE Bug 1283528
- SUSE Bug 1283786
- SUSE Bug 1283787
- SUSE Bug 1284404
- SUSE Bug 1284405
- SUSE CVE CVE-2026-101276 page
- SUSE CVE CVE-2026-101283 page
- SUSE CVE CVE-2026-102253 page
- SUSE CVE CVE-2026-71217 page
- SUSE CVE CVE-2026-71218 page
Описание
iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.
Затронутые продукты
Ссылки
- CVE-2026-101276
- SUSE Bug 1283786
Описание
iperf3 3.20-3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22
Затронутые продукты
Ссылки
- CVE-2026-101283
- SUSE Bug 1283787
Описание
iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.
Затронутые продукты
Ссылки
- CVE-2026-102253
- SUSE Bug 1283528
Описание
A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.
Затронутые продукты
Ссылки
- CVE-2026-71217
- SUSE Bug 1284405
Описание
A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.
Затронутые продукты
Ссылки
- CVE-2026-71218
- SUSE Bug 1284404