This update for iperf fixes the following issues:
- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via
resource exhaustion (bsc#1284405).
- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion
(bsc#1284404).
- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-
test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).
- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buff
This update for iperf fixes the following issues:
- update to 3.19.1:
* CVE-2025-54351: Fixed buffer overflow in net.c (bsc#1247522)
* CVE-2025-54350: Fixed Base64Decode assertion failure and application
exit upon a malformed authentication attempt (bsc#1247520)
* CVE-2025-54349: Fixed off-by-one error and resultant heap-based
buffer overflow (bsc#1247519)
- update to 3.19:
* iperf3 now supports the use of Multi-Path TCP (MPTCPv1) on Linux
with the use of the `-m` or `--mptcp` flag. (PR #1661)
* iperf3 now supports a `--cntl-ka` option to enable TCP keepalives
on the control connection. (#812, #835, PR #1423)
*