{"id":"MGASA-2026-0539","summary":"Updated iperf package fixes security vulnerabilities","details":"Iperf3 server accepts unbounded peer-controlled json parameters enabling\nremote denial of service via resource exhaustion. (CVE-2026-71217)\nUnbounded peer-controlled allocation in iperf3 json_read() allows\nunauthenticated remote memory exhaustion. (CVE-2026-71218)\nIperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap\nuse-after-free: the server's per-test watchdog server_timer_proc() frees\nstreams without cancelling/joining their worker threads, so a blocked\nworker dereferences a freed iperf_stream. (CVE-2026-101276)\nIperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in\ndecrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the\nattacker-controlled ciphertext length (guard warns only), so an\nunauthenticated client overflows the heap via an oversized authtoken.\n(CVE-2026-101283)\nIperf3 \u003c 3.22 UDP Receive Worker Infinite Loop DoS. (CVE-2026-102253)\n","modified":"2026-10-25T01:28:00.230203178Z","published":"2026-10-25T01:13:22Z","upstream":["CVE-2026-101276","CVE-2026-101283","CVE-2026-102253","CVE-2026-71217","CVE-2026-71218"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0539.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=36548"},{"type":"WEB","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WVURYNW7KMOY3RQC6OJUZLHYUU5HP4Y3/"}],"affected":[{"package":{"name":"iperf","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/iperf?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0539.json"}}],"schema_version":"1.9.2","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}