Critical Base64Decode Assertion Failure in iperf3 Package
Summary
CVE-2025-54350: In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt. Affects iperf3 across 3 version ranges.
< 0fa686ef204229a02dcc21a48823ebd47e60e9a2
< 3.19.1-r0
< 4eab661da0bbaac04493fa40164e928c6df7934a
Fixed in 3.19.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
iperf3 is a widely used network performance measurement tool that allows users to test the bandwidth between two hosts. It is known for its ability to generate TCP and UDP traffic and measure the throughput of a network. The package is essential for network administrators and engineers who need to assess the performance of their networks. However, a vulnerability has been identified in iperf3 that could lead to application crashes under certain conditions.
Vulnerability Detail
In iperf versions prior to 3.19.1, there exists a vulnerability in the iperf_auth.c file that leads to an assertion failure during Base64 decoding. This occurs when a malformed authentication attempt is made, resulting in the application exiting unexpectedly. The vulnerability could be exploited by an attacker to disrupt service availability, making it critical for users to address this issue promptly. The CVSS score for this vulnerability is 5.3, indicating a moderate level of severity.
How To Fix
Minimum fixed version
3.19.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade iperf3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the authentication feature in iperf3 until they can update to the patched version. This will help prevent the application from crashing due to malformed authentication attempts.
Conclusion
The iperf3 package has a critical vulnerability that can lead to application crashes due to a Base64Decode assertion failure. It is essential for users to update to version 3.19.1 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for iperf3 →
FAQ
The vulnerability is an assertion failure during Base64 decoding in iperf_auth.c, which leads to application crashes upon malformed authentication attempts.
You can check your version of iperf3 by running 'iperf3 --version' in the terminal. If it is below 3.19.1, it is affected.
The vulnerability can lead to service disruptions, as the application may crash when a malformed authentication attempt is made.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for iperf3.
