RHSA-2026:61257: Important: iperf3 security update
Important: iperf3 security update
Other sources
Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.Security Fix(es): iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (CVE-2026-71217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/iperf3to a version that resolves this vulnerability.Fixed in 3.5-12.el8_10.1 - Upgrade
Upgrade
redhat/iperf3-debuginfoto a version that resolves this vulnerability.Fixed in 3.5-12.el8_10.1 - Upgrade
Upgrade
redhat/iperf3-debugsourceto a version that resolves this vulnerability.Fixed in 3.5-12.el8_10.1 - Upgrade
Upgrade
redhat/iperf3to a version that resolves this vulnerability.Fixed in 3.5-12.el8_10.1.aa - Upgrade
Upgrade
redhat/iperf3-debuginfoto a version that resolves this vulnerability.Fixed in 3.5-12.el8_10.1.aa - Upgrade
Upgrade
redhat/iperf3-debugsourceto a version that resolves this vulnerability.Fixed in 3.5-12.el8_10.1.aa
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs to be able to connect to an iperf3 server and supply peer-controlled JSON parameters. The issue can then be used remotely to exhaust resources and cause a denial of service.
Which systems should be prioritized for remediation?
Prioritize systems running an iperf3 server, particularly where the service is reachable by untrusted or remote clients. The advisory lists affected Red Hat Enterprise Linux variants for ARM 64, x86_64 Extended Life Cycle, IBM z Systems, and Power little endian.