Critical Buffer Overflow in iperf3: A Security Flaw Exposed
Summary
CVE-2025-54351: In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv). Affects iperf3 across 3 version ranges.
< 0fa686ef204229a02dcc21a48823ebd47e60e9a2
< 3.19.1-r0
< 969b7f70c447513e92c9798f22e82b40ebc53bf0
Fixed in 3.19.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
iperf3 is a widely used network testing tool that measures the maximum TCP and UDP bandwidth performance. It is designed to create and measure the performance of network connections, making it essential for network engineers and administrators. However, prior to version 3.19.1, iperf3 contained a critical vulnerability that could lead to severe security implications.
Vulnerability Detail
The vulnerability, identified as CVE-2025-54351, is a buffer overflow issue present in the net.c file of iperf3 when the '--skip-rx-copy' option is used in conjunction with MSG_TRUNC in the recv function. This flaw allows an attacker to exploit the buffer overflow, potentially leading to arbitrary code execution, data corruption, or a denial of service. The severity of this vulnerability is underscored by its CVSS score of 10.0, indicating a critical risk level.
How To Fix
Minimum fixed version
3.19.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade iperf3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the '--skip-rx-copy' option until the package is updated to a secure version. This will help prevent the exploitation of the buffer overflow vulnerability.
Conclusion
The buffer overflow vulnerability in iperf3 (CVE-2025-54351) poses a significant risk to users, with potential for severe exploitation. It is crucial to update to the patched version to ensure network security. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for iperf3 →
FAQ
CVE-2025-54351 is a critical buffer overflow vulnerability in iperf3 that can lead to arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2025-54351 is 10.0, indicating a critical level of severity.
If an immediate update is not possible, avoid using the '--skip-rx-copy' option as a temporary workaround.
More information about iperf3 can be found on its official GitHub repository at https://github.com/esnet/iperf.
Related vulnerabilities
Recent vulnerabilities recorded for iperf3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
