Critical Buffer Overflow in iperf3 Package - CVE-2025-54351
Summary
ALPINE-CVE-2025-54351: In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv). Affects iperf3 versions < 3.19.1-r0. Fixed in 3.19.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
iperf3 is a widely used network performance measurement tool that allows users to test the bandwidth between two hosts. It is known for its ability to generate TCP and UDP traffic and measure the throughput of a network. The tool is essential for network administrators and engineers to diagnose network issues and optimize performance. However, prior to version 3.19.1, iperf3 contained a critical vulnerability that could lead to severe security risks.
Vulnerability Detail
The vulnerability identified as CVE-2025-54351 is a buffer overflow issue located in the net.c file of iperf3. This flaw occurs when the '--skip-rx-copy' option is used, particularly in conjunction with the MSG_TRUNC flag during the recv operation. If exploited, this vulnerability could allow an attacker to execute arbitrary code, potentially compromising the affected system. The severity of this vulnerability is underscored by its CVSS score of 10.0, indicating a critical risk level.
How To Fix
Minimum fixed version
3.19.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade iperf3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the '--skip-rx-copy' option when running iperf3 to mitigate the risk of this vulnerability until an update can be applied.
Conclusion
CVE-2025-54351 represents a significant security risk for users of the iperf3 package due to a buffer overflow vulnerability. It is crucial for users to update to the patched version 3.19.1-r0 to mitigate potential threats. Until then, avoiding specific command options can help reduce exposure.
See every vulnerability recorded for iperf3 →
FAQ
CVE-2025-54351 is a critical buffer overflow vulnerability in the iperf3 package that can lead to arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2025-54351 is 10.0, indicating a critical level of severity.
If an immediate update is not possible, avoid using the '--skip-rx-copy' option as a temporary workaround to reduce risk.
For real-time monitoring and alerts on open-source vulnerabilities, you can visit Vulert at https://vulert.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for iperf3.
