Critical Buffer Overflow Vulnerability in iperf3: CVE-2025-54349
Summary
CVE-2025-54349: In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. Affects iperf3 across 3 version ranges.
< 0fa686ef204229a02dcc21a48823ebd47e60e9a2
< 3.19.1-r0
< 4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf
Fixed in 3.19.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
iperf3 is a widely used network testing tool that measures the maximum TCP and UDP bandwidth performance. It is essential for network performance evaluation and troubleshooting. The tool is known for its ability to generate traffic and analyze the performance of networks. However, it has been found to be susceptible to a critical vulnerability that can lead to severe security risks.
Vulnerability Detail
In iperf versions prior to 3.19.1, an off-by-one error in the iperf_auth.c file can lead to a heap-based buffer overflow. This vulnerability allows attackers to exploit the flaw, potentially leading to arbitrary code execution, data corruption, or crashes. The vulnerability is classified with a CVSS score of 10.0, indicating a critical severity level, which means that it poses a significant risk to systems using affected versions of iperf3.
How To Fix
Minimum fixed version
3.19.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade iperf3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected features of iperf3 until the package is updated. It is advisable to monitor network traffic closely and limit access to the iperf3 tool to trusted users only.
Conclusion
CVE-2025-54349 represents a critical vulnerability in iperf3 that can lead to severe security issues. Users are strongly advised to update to the latest version to mitigate risks. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for iperf3 →
FAQ
CVE-2025-54349 is a critical vulnerability in iperf3 that can lead to a heap-based buffer overflow due to an off-by-one error.
You can check your version of iperf3 by running 'iperf3 --version' in your terminal. If it is below 3.19.1, it is affected.
The vulnerability can lead to arbitrary code execution, data corruption, or crashes, posing significant risks to system integrity and security.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for iperf3.
