iperf3: Heap buffer overflow in RSA message decryption
Summary
iperf3 versions 3.20 and 3.21 contain a heap buffer overflow in decrypt_rsa_message(). A 256-byte RSA buffer is filled using an attacker-controlled ciphertext length, so an unauthenticated remote client can overflow the heap via an oversized authtoken. The CVE record rates this as critical (CVSS 4.0 9.2); exploitation requires only network access to an iperf3 server. The upstream release notes map the CVE IDs differently, so the mapping still needs confirmation.
Affected
- ESnet iperf3 3.20
- ESnet iperf3 3.21
- Distribution builds based on these versions (e.g. Debian packages; check the tracker for the exact build)
Fixed in
- iperf3 3.22 (upstream release dated 2026-09-29)
- Amazon Linux lists 3.22 as fixed; Flatcar requires 3.22 or later
Workaround
- No official workaround from the vendor; upgrading to 3.22 is the remedy.
- Interim (general practice): stop running iperf3 in server mode when not needed and block TCP port 5201 from untrusted networks.
- Enabling iperf3 authentication is not a verified mitigation.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No evidence of exploitation in the wild or public proof of concept found; this is not proof that none exists.
- A third-party tracker reports the CVE is not in CISA KEV (not verified). EPSS is 0.0028 (low).
Our recommendation
- Inventory iperf3 on servers, containers, appliances and Linux images and upgrade to 3.22 or later.
- Confirm that no iperf3 server is reachable from the internet or untrusted networks; restrict port 5201 and do not run iperf3 as a permanent service.
- Check the Debian tracker for the fixed build in your release.
- Upgrading to 3.22 covers both disputed IDs. Ask the vendor or CVE program to confirm the CVE mapping.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ESnet iperf 3.22 release notes (vendor) github.com
- OSV: CVE-2026-101283 (Debian versions) osv.dev
- VulDB: CVE-2026-101283 (third-party analysis) vuldb.com
- Flatcar issue 2440 (distribution action) github.com
- Amazon Linux advisory ALAS2023-2026-3299 (fixed version) vulners.com
- Amazon Linux security advisories (ALAS2027) alas.aws.amazon.com
- Strix: CVE-2026-101283 (third-party KEV status) www.strix.ai
- OpenCVE: CVE-2026-101283 (CVE text) app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:58.
Original description (NVD)
iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.