Critical Base64Decode Assertion Failure in iperf3 - CVE-2025-54350
Summary
ALPINE-CVE-2025-54350: In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt. Affects iperf3 versions < 3.19.1-r0. Fixed in 3.19.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
iperf3 is a widely used network testing tool that measures the maximum TCP and UDP bandwidth performance. It is known for its ability to generate traffic and analyze network performance metrics. However, prior to version 3.19.1, iperf3 contained a vulnerability in the iperf_auth.c file that could lead to application crashes upon receiving malformed authentication attempts.
Vulnerability Detail
The vulnerability identified as CVE-2025-54350 is an assertion failure in the Base64Decode function within iperf3's authentication handling. This flaw allows an attacker to trigger an application exit by sending a malformed authentication request. The ramifications of this vulnerability include potential denial of service, as legitimate users may be unable to use the application if it crashes. The technical aspect of this vulnerability lies in improper input validation, which fails to handle unexpected data formats correctly.
How To Fix
Minimum fixed version
3.19.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade iperf3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the client-side to ensure that only properly formatted authentication requests are sent to the iperf3 server. This can help mitigate the risk of triggering the assertion failure until the package is updated.
Conclusion
CVE-2025-54350 presents a significant risk to iperf3 users due to its potential to cause application crashes from malformed authentication requests. It is crucial to update to the latest version to mitigate this risk and ensure continued network performance testing capabilities.
See every vulnerability recorded for iperf3 →
FAQ
CVE-2025-54350 is a vulnerability in iperf3 that causes an assertion failure and application exit when a malformed authentication attempt is made.
Users may experience application crashes, leading to denial of service and inability to perform network tests.
Versions of iperf3 prior to 3.19.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2025-54350 is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for iperf3.
