REDHAT-BUG-2543638: High severity iperf3 iperf3 vulnerability

Q: What must an attacker be able to do to trigger this issue?

The attacker must be able to reach the iperf3 server remotely. No authentication is required; exploitation uses a crafted control-channel parameter message followed by a 16-byte UDP datagram.

Q: Which deployments are affected?

iperf3 versions earlier than 3.22 are affected. The issue targets the server's UDP receive worker, so exposure depends on running an affected iperf3 server that accepts the relevant remote traffic.

Q: What is the operational impact after exploitation?

A successful attack can force the affected per-stream receive thread into an unrecoverable infinite loop at approximately 100% CPU, making the server unusable. Normal control-channel closure does not recover the process.

Q: What can be done if the server is already stuck?

The affected iperf3 process must be forcibly terminated with SIGKILL to recover. Upgrading to version 3.22 or later removes exposure to the described affected versions.

Published Sep 29, 2026

Updated

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

Affected Software

1 affected component

iperf3 iperf3<3.22

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade iperf3 to a version that resolves this vulnerability.
Fixed in 3.22

Event History

Sep 29, 2026

Data Sourced

via Red Hat·08:36 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker be able to do to trigger this issue?

The attacker must be able to reach the iperf3 server remotely. No authentication is required; exploitation uses a crafted control-channel parameter message followed by a 16-byte UDP datagram.

Which deployments are affected?

iperf3 versions earlier than 3.22 are affected. The issue targets the server's UDP receive worker, so exposure depends on running an affected iperf3 server that accepts the relevant remote traffic.

What is the operational impact after exploitation?

A successful attack can force the affected per-stream receive thread into an unrecoverable infinite loop at approximately 100% CPU, making the server unusable. Normal control-channel closure does not recover the process.

What can be done if the server is already stuck?

The affected iperf3 process must be forcibly terminated with SIGKILL to recover. Upgrading to version 3.22 or later removes exposure to the described affected versions.

REDHAT-BUG-2543638: High severity iperf3 iperf3 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to do to trigger this issue?

Which deployments are affected?

What is the operational impact after exploitation?

What can be done if the server is already stuck?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to trigger this issue?

Which deployments are affected?

What is the operational impact after exploitation?

What can be done if the server is already stuck?