Updated iperf package fixes security vulnerabilities
Publication date: 25 Oct 2026Modification date: 25 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-71217 , CVE-2026-71218 , CVE-2026-101276 , CVE-2026-101283 , CVE-2026-102253
Description
Iperf3 server accepts unbounded peer-controlled json parameters enabling
remote denial of service via resource exhaustion. (CVE-2026-71217)
Unbounded peer-controlled allocation in iperf3 json_read() allows
unauthenticated remote memory exhaustion. (CVE-2026-71218)
Iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap
use-after-free: the server's per-test watchdog server_timer_proc() frees
streams without cancelling/joining their worker threads, so a blocked
worker dereferences a freed iperf_stream. (CVE-2026-101276)
Iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in
decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the
attacker-controlled ciphertext length (guard warns only), so an
unauthenticated client overflows the heap via an oversized authtoken.
(CVE-2026-101283)
Iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS. (CVE-2026-102253)
References
- https://bugs.mageia.org/show_bug.cgi?id=36548
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WVURYNW7KMOY3RQC6OJUZLHYUU5HP4Y3/
- https://www.cve.org/CVERecord?id=CVE-2026-71217
- https://www.cve.org/CVERecord?id=CVE-2026-71218
- https://www.cve.org/CVERecord?id=CVE-2026-101276
- https://www.cve.org/CVERecord?id=CVE-2026-101283
- https://www.cve.org/CVERecord?id=CVE-2026-102253
SRPMS
10/core
- iperf-3.22-1.mga10