Critical Buffer Overflow Vulnerability in iperf3 Package
Summary
ALPINE-CVE-2025-54349: In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. Affects iperf3 versions < 3.19.1-r0. Fixed in 3.19.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
iperf3 is a widely used network testing tool that measures the maximum TCP and UDP bandwidth performance. It is known for its ability to generate traffic and measure the performance of a network connection. The tool is often utilized by network administrators and engineers to diagnose network issues and optimize performance. However, prior to version 3.19.1, iperf3 contained a critical vulnerability that could lead to severe security implications.
Vulnerability Detail
In iperf3 versions before 3.19.1, an off-by-one error in the iperf_auth.c file can lead to a heap-based buffer overflow. This vulnerability allows attackers to potentially execute arbitrary code, leading to unauthorized access and control over the affected system. The flaw arises from improper handling of memory allocation, which can be exploited to overwrite adjacent memory, causing unpredictable behavior and system crashes.
How To Fix
Minimum fixed version
3.19.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade iperf3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the iperf3 service or run it in a controlled environment to mitigate the risk of exploitation until the package is updated.
Conclusion
The iperf3 package has a critical vulnerability that can lead to severe security implications if not addressed. Users are strongly advised to update to version 3.19.1 or later to protect their systems from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for iperf3 →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to arbitrary code execution, unauthorized access, and control over the affected system, posing significant security risks.
Yes, you should upgrade to iperf3 version 3.19.1 or later to mitigate this vulnerability.
An off-by-one error is a common programming mistake where a loop or array index is incorrectly calculated, leading to buffer overflows or underflows.
References
Related vulnerabilities
Recent vulnerabilities recorded for iperf3.
