{"id":"CVE-2026-71217","summary":"Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion","details":"A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.","modified":"2026-08-31T13:56:55.699199015Z","published":"2026-08-11T08:50:10.140Z","related":["ALSA-2026:61257"],"database_specific":{"cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71217.json","cna_assigner":"redhat"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-71217"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71217.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71217"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460984"},{"type":"FIX","url":"https://github.com/esnet/iperf/commit/494dd377eca4689672becdf06a85158557db1586"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/esnet/iperf","events":[{"introduced":"0"},{"fixed":"494dd377eca4689672becdf06a85158557db1586"}],"database_specific":{"source":"REFERENCES"}}],"versions":["3.21","3.20","3.19","3.18","3.17.1","3.16","3.16-beta1","3.15","3.14","3.13","3.12","3.11","3.10.1","3.10","3.9","3.8.1","3.8","3.7","3.6","3.5","3.4","3.3","3.2","3.2rc1","3.1","3.1b3","3.1b2","3.1b1","3.0.4","3.0.1","3.0-BETA5","3.0-BETA4","3.0-BETA3","3.0-BETA2","3.0-BETA1","iperf3","3.0-ALPHA1","iperf-3.0a1","trunk","2.0.4-RELEASE","2.0.3-RELEASE","2.0.2-RELEASE","2.0.1-RELEASE","2.0-RELEASE"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-71217.json","vanir_signatures_modified":"2026-08-18T18:39:16Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"103025360546791018506123635547113238435","length":6324},"id":"CVE-2026-71217-3c3119f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/esnet/iperf/commit/494dd377eca4689672becdf06a85158557db1586","target":{"file":"src/iperf_api.c","function":"get_parameters"}},{"digest":{"line_hashes":["181412756766557406613961847052063549254","316178886760695410445125310491752207707","283817775609820572855166240161872654712","8004742427457165786232270028537034876","14342034747770940282114828061084483775","198970859888211696596208456435468804507","277744075145560961171862092101195347374","143389788567679367788629952765724361766","60508279048053298899140120860162030160","281293055797531128653504854418782285359","113683539234835500533503440402624729790","263269078588656611152108961393500142551","201729845273710056267077557970244933255","57285294930675743227983389485042379387","282102911081794884339616629616338288790","290413921804449726943995930388182645002","81730925219456142732323942880310300296","216944196326028785179127954274114060949","284594090892042051482645297851588972538","331344725955557579820062178263743566158","62094782440310499759852946838387442238","86422330567179430397348171735815768599","80114900762019881246737374271775332236","80915346787063919467768364304604463303","207988343694083697823350692865634955463","300122963415932913628178403605159300762","22993068445122083683507254313412333361","97592269354167430853376696030391590945","207988343694083697823350692865634955463","300122963415932913628178403605159300762","157137686231309448843736398647367116773","335787359937888436170913939183089316054","207988343694083697823350692865634955463","300122963415932913628178403605159300762","121384934779234426514344713913866960529","205874161988892620978040784577825873888","312983643018885298757947176873123338476","235987457403868915447427521357614618143","250329773298628889858834654146434744833","167150991615171579764126403813149874515","87226529483881243696276518486587177977","302917485846554731031035375508527433046","118940943163628771069748806287767745985","213658395835573794180857846030345211400","98315161488770404561909904203376519063","266403496251470844848834813743741692698","199207599978613293491101818164968075201","337930645289230251189160639326327219784","83368646978414225772689620244248131640","33296388739129916591999116580923499079","207988343694083697823350692865634955463","44244784357205068649072485036947683173","314229241541517042678351590666976208179","286467950898005044550107986600016019232","276382755786733125865424648111321414207","207988343694083697823350692865634955463","300122963415932913628178403605159300762","229757517479385354159986599266557883515","241007547143950742943307137800508416487","338475258397113008962661570981399259190","157340733319775094687774088634058709984","168633411155283398904344007302946198030","207988343694083697823350692865634955463","300122963415932913628178403605159300762","128150762634522466601489145208091238444","333434389873589928767009254732866369353","323181214860577320567503441047363721908","140329831316119688688472152340162065978","269072482555895836183363776607245295598","231554709923743816595050795232994446360","10810782133480687940902445892177658646","268923499646322400793653762500753260528","174167132373414886420769551758848985734","246278723171754812753360000938026728085","114322930202809735965497646778070168056","188653588698711402765187933237751602199","69476177073454583432648345436846832260","228750450899494139111698087731448609012","10266985309519963931088591373746550010","305653491541846409548483404700678586422","211115819023341818807633777059083180174","320709173437960923949213534871419252938","57080681887900061320943088932979397592","100745113431958773669632698582671127257","236170774185116382967879424217022337165","266484953606754701459562085550807371105","237907456299250898421165176794210020267","229974365253714854584940742347890967003","155241509384899998962723864371839822171","155621502273811142932790036853521612677","188111170933818323091055855420632887201","288133352747867246804351605187298457579","141083790463724561325984383731405887121","167698258262890657634409496521701683795","277216973648303819162159590417535968382","29079482681278124773590973340244294312","117698854628872785016169494152471946161","53613394165054299720850881570155035250","300607274769943885971842238225578033129","248230633540113319096293434709882310713","136264993756014457977634267702217962079","79364342082656133987478824191326872270","50730408100772357356876047853917129568","14546360217625530225158740719179915216","135794708292670810379741875977232422817","236399762731068334869097447119497735901","22869856503836120969880734755643674626","321657795781172125763998816717633357636","200157339589736219915267425751775096917","324544887284420173269525771899241212537","328933314477221612764992952496337830409","42300294906943862702683260002601316116","236261882023006258699633900127336006570","130233182775853735803242125073088419255","152142467557875397310221097365871157349","169275139694331357601102224134082378307","55913442221524877806582414284021420875","220790273480005565327556246024273615747","17072218818403613762377511959506148623","83587284817742436610454337659114721432","265805130695150256394002700838087752707","283801185467390415022139194353774972755","3473099551235522843672571266097267878","338265513199993370893074886614393314881","302154356710636600875013708120702847055","217147324700502035799061307709661010070","44802751828850760277043971253856599690","249141532434943811595605987679896014446","57191450823333288435006682197411570181","218465683441435180023402709746316639197","95183345734432633252607109303387803852","177212928868951210693682989548899268132","303934258092460828214241209944031419617","195450724272119691550832922388766958064","3384293008299910250232741248882165706","58996158322429976325041275647891713328","59670958481966239086648743926299546723","26040777811565188259274472152460217658","289254719187013897128530964921018900394","133961202893726180620117849223233019626","337043673404765130577595510343574895633","143007755703290785165566594287145713890","103712506125241860478723094886422447516","229033055107188092652929470879236978466","169829845078065371838271400656059754500","279266163846988364688769645544736084066","127886058585011931341447640518115810322","214431652430816891564570696001298628879","119420973903324208743036605753773046431","6399337485819791098960528818382014886","224327509933084816162729547245650544831","255176163710804406422154161438120440032","303646743596214321495874413322891830915","253085238073555856445888669246393506628","158947993474566621499176439489699599610","249341933009667883227125025671439739983","10810782133480687940902445892177658646","150480273720287655435419807330057999090","283147771461023702848451374426783083469","13671044281188577113596627164340235084"],"threshold":0.9},"id":"CVE-2026-71217-c6d2caa2","signature_type":"Line","signature_version":"v1","source":"https://github.com/esnet/iperf/commit/494dd377eca4689672becdf06a85158557db1586","target":{"file":"src/iperf_api.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/esnet/iperf/commit/494dd377eca4689672becdf06a85158557db1586","target":{"file":"src/iperf_api.c","function":"iperf_parse_arguments"},"deprecated":false,"digest":{"length":23273,"function_hash":"161413016415223413905491677975764999833"},"id":"CVE-2026-71217-db3e3110"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}