CVE-2026-71217 in iperf3
Summary
by MITRE • 08/11/2026
A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in iperf3 represents a critical security flaw that demonstrates poor input validation practices in network performance testing software. This issue resides within the control channel processing logic where JSON parameters are parsed without adequate bounds checking or sanitization. The specific parameters affected include `parallel` and `len` fields which are commonly used to configure test parameters such as the number of parallel streams and the length of data to be transmitted. When these numeric values exceed reasonable limits, the server fails to validate their magnitude before proceeding with resource allocation operations.
The technical execution of this vulnerability involves a remote attacker crafting malicious JSON control messages containing excessively large numeric values that trigger unbounded resource consumption. The server processes these parameters without proper validation, leading to cascading resource allocation failures. When the `parallel` parameter is set to an extremely high value, the system attempts to create an corresponding number of streams and threads, exhausting system resources through thread pool exhaustion. Similarly, oversized `len` values cause the allocation of massive buffers that can overwhelm memory resources and potentially trigger out-of-memory conditions.
This vulnerability directly maps to CWE-129, which addresses improper validation of array indices and other numeric parameters in input processing systems. The flaw also aligns with ATT&CK technique T1499.004, covering network denial of service attacks through resource exhaustion. The operational impact extends beyond simple server unavailability as the resource exhaustion can cause cascading failures throughout dependent systems that rely on iperf3 for network performance testing and monitoring. The vulnerability affects both IPv4 and IPv6 implementations, making it particularly dangerous in modern network environments where multiple address families may be in use simultaneously.
The mitigation strategy requires implementing strict parameter validation at the control channel level with predefined maximum limits for all numeric parameters. Server implementations should enforce reasonable upper bounds for `parallel` values to prevent thread explosion scenarios and limit buffer size allocations to prevent memory exhaustion. Additionally, implementing rate limiting and connection pooling mechanisms can help reduce the impact of malicious requests while maintaining legitimate service availability. Regular input sanitization and parameter validation should be integrated into all JSON parsing operations within network protocol implementations to prevent similar issues from occurring in other components of the software stack.