This update for iperf fixes the following issues:
- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via
resource exhaustion (bsc#1284405).
- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion
(bsc#1284404).
- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-
test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).
- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buff
This update for iperf fixes the following issues:
- update to 3.19.1:
* CVE-2025-54351: Fixed buffer overflow in net.c (bsc#1247522)
* CVE-2025-54350: Fixed Base64Decode assertion failure and application
exit upon a malformed authentication attempt (bsc#1247520)
* CVE-2025-54349: Fixed off-by-one error and resultant heap-based
buffer overflow (bsc#1247519)
- update to 3.19:
* iperf3 now supports the use of Multi-Path TCP (MPTCPv1) on Linux
with the use of the `-m` or `--mptcp` flag. (PR #1661)
* iperf3 now supports a `--cntl-ka` option to enable TCP keepalives
on the control connection. (#812, #835, PR #1423)
*
This update for iperf fixes the following issues:
- Update to version 3.18
- CVE-2024-53580: Fixed a segmentation violation via the iperf_exchange_parameters() function. (bsc#1234705)
This update for iperf fixes the following issues:
- Update to version 3.17.1
- CVE-2024-26306: Fixed a vulnerability that could led to marvin attack if the authentication option is used. (bsc#1224262)
This update for iperf fixes the following issues:
- update to 3.15 (bsc#1215662, ESNET-SECADV-2023-0002):
* Several bugs that could allow the iperf3 server to hang waiting
for input on the control connection has been fixed
(ESnet Software Security Advisory ESNET-SECADV-2023-0002)
* A bug that caused garbled output with UDP tests on 32-bit hosts
has been fixed (PR #1554, PR #1556). This bug was introduced in
iperf-3.14.
* A bug in counting UDP messages has been fixed
- update to 3.14 (bsc#1213430, CVE-2023-38403):
* fixes a memory allocation hazard that allowed a remote user to
crash an iperf3 process
* see http