CVE-2026-71218 in iperf3
Summary
by MITRE • 08/11/2026
A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in iperf3 represents a critical memory management flaw that fundamentally compromises the availability of network performance testing services. This issue manifests within the JSON_read() function where the application processes peer-controlled input without implementing adequate bounds checking on message length parameters. The flaw creates an environment where remote attackers can manipulate the memory allocation behavior by sending specially crafted JSON messages with exaggerated length values, effectively bypassing normal input validation mechanisms that should protect against malformed data processing.
The technical execution of this vulnerability relies on the absence of size constraints during memory allocation operations within the JSON parsing routine. When iperf3 receives a JSON message from an unauthenticated remote peer, the JSON_read() function directly uses the reported message length to determine memory allocation size without validating whether this value falls within reasonable operational bounds. This design flaw enables attackers to specify arbitrarily large memory allocation requests that can quickly exhaust available system resources, particularly affecting systems with limited memory capacity or those operating under strict resource constraints.
From an operational impact perspective, this vulnerability creates a severe denial of service condition where legitimate users cannot access iperf3 services due to the application consuming all available memory resources. The service may experience complete termination, significant performance degradation, or become unresponsive to legitimate network testing requests. The attack requires minimal privileges as it targets an unauthenticated interface, making it particularly dangerous for publicly accessible iperf3 instances that are commonly used for network diagnostics and performance measurement across various network infrastructures.
The vulnerability aligns with CWE-122 (Heap-based Buffer Overflow) and CWE-770 (Allocation of Resources Without Limits or Throttling) categories, representing a classic example of unchecked memory allocation that enables resource exhaustion attacks. From an attack framework perspective, this weakness maps to ATT&CK technique T1499.004 (Endpoint Denial of Service) and demonstrates how improper input validation can lead to service disruption. The flaw particularly affects systems where iperf3 is deployed as a server component accepting connections from untrusted networks, commonly found in enterprise environments where network performance testing tools are exposed to external traffic.
Mitigation strategies should focus on implementing strict bounds checking within the JSON parsing functions, establishing maximum message length limits, and incorporating memory allocation validation before processing peer-controlled data. System administrators should consider deploying iperf3 in restricted network environments with proper access controls and firewall rules to limit exposure to untrusted networks. Additionally, regular firmware and software updates should be implemented to ensure that known vulnerabilities are addressed through proper code review processes that emphasize secure memory management practices and input validation controls. The implementation of rate limiting mechanisms and connection pooling can further reduce the impact of such attacks by preventing rapid successive resource exhaustion attempts from a single malicious source.