{"id":"CVE-2026-71218","title":"Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion","summary":"A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-789"],"vendor":"Red Hat","product":"iperf3","affected":["iperf3 (all versions)","iperf3 (all versions)","iperf3 (all versions)","iperf3 (all versions)"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-11T12:54:34.803644Z"},"published":"2026-08-11","updated":"2026-11-05","sourceUpdated":"2026-11-05T22:52:28.203Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-71218","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-71218"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463003","label":"RHBZ#2463003"},{"url":"https://github.com/esnet/iperf/commit/0128d0357b7e8916fe39e980e455729bc0e5fd4e"}],"tags":["cve.org"],"epss":0.00383,"epssPercentile":0.32643,"ingestedAt":"2026-11-05T23:41:31.937Z","slug":"CVE-2026-71218","body":"## Overview\n\nA flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.\n\n## Affected\n\n- `iperf3 (all versions)`\n- `iperf3 (all versions)`\n- `iperf3 (all versions)`\n- `iperf3 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this issue, restrict network access to the `iperf3` control port, ensuring it is only reachable by trusted clients. This can be achieved by configuring firewall rules to limit inbound connections to the `iperf3` service. Additionally, consider running the `iperf3` service within environments that enforce process or container memory limits to further contain potential resource exhaustion. Note that authentication alone is insufficient as the memory allocation occurs before authentication checks.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}