---
id: CVE-2026-71218
title: >-
  Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows
  unauthenticated remote memory exhaustion
summary: >-
  A flaw was found in iperf3. A remote unauthenticated attacker can exploit a
  vulnerability in the `JSON_read()` function, which accepts a peer-controlled
  message length and allocates memory without an upper bound. This allows the
  attacker…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-789
vendor: Red Hat
product: iperf3
affected:
  - iperf3 (all versions)
  - iperf3 (all versions)
  - iperf3 (all versions)
  - iperf3 (all versions)
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-11T12:54:34.803644Z'
published: '2026-08-11'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:52:28.203Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-71218'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-71218'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2463003'
    label: RHBZ#2463003
  - url: >-
      https://github.com/esnet/iperf/commit/0128d0357b7e8916fe39e980e455729bc0e5fd4e
tags:
  - cve.org
epss: 0.00383
epssPercentile: 0.32643
ingestedAt: '2026-11-05T23:41:31.937Z'
---

## Overview

A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.

## Affected

- `iperf3 (all versions)`
- `iperf3 (all versions)`
- `iperf3 (all versions)`
- `iperf3 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, restrict network access to the `iperf3` control port, ensuring it is only reachable by trusted clients. This can be achieved by configuring firewall rules to limit inbound connections to the `iperf3` service. Additionally, consider running the `iperf3` service within environments that enforce process or container memory limits to further contain potential resource exhaustion. Note that authentication alone is insufficient as the memory allocation occurs before authentication checks.