CVE-2026-102253: iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
Other sources
iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
iperf3to a version that resolves this vulnerability.Fixed in 3.22
Event History
Frequently Asked Questions
Which deployments are exposed?
iperf3 servers running a version earlier than 3.22 are affected when handling UDP receive streams. The attack can be performed remotely without authentication.
What does an attacker need to send?
Exploitation requires a single crafted control-channel parameter message followed by one 16-byte UDP datagram. No privileges or user interaction are required.
How can an affected server be identified during an incident?
An affected per-stream UDP receive thread can remain pinned at approximately 100% CPU and make the server unusable. Closing the normal control channel does not stop the loop.
What recovery action is available if the process is already stuck?
The affected process must be forcibly terminated with SIGKILL, because it does not recover through normal control-channel closure.