Moderate Security Vulnerability in iperf3: Heap Buffer Overflow
Summary
ALSA-2026:1595: Moderate: iperf3 security update. Affects iperf3 versions < 3.9-14.el9_7.1. Fixed in 3.9-14.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Iperf3 is a widely used tool for measuring maximum TCP bandwidth and tuning various parameters related to UDP characteristics. It provides valuable metrics such as bandwidth, delay jitter, and datagram loss, making it essential for network performance testing. However, a recently discovered vulnerability poses a risk to its users.
Vulnerability Detail
The vulnerability identified as CVE-2025-54349 is a heap buffer overflow in iperf3. This flaw can be exploited by an attacker to execute arbitrary code or crash the application, potentially leading to unauthorized access or denial of service. The issue arises from improper handling of memory allocation, which can be manipulated to overwrite adjacent memory locations.
How To Fix
Minimum fixed version
3.9-14.el9_7.1
This is the first release that contains the fix.
sudo dnf update iperf3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of iperf3 by restricting access to trusted networks and users only. Additionally, disabling any unnecessary features that may expose the application to untrusted input can help mitigate the risk until a patch is applied.
Conclusion
The iperf3 security update addresses a critical heap buffer overflow vulnerability that could compromise system integrity. Users are strongly advised to update to the latest version to mitigate risks associated with this flaw. Monitoring tools like Vulert can assist in maintaining awareness of vulnerabilities in your software.
See every vulnerability recorded for iperf3 →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior.
Exploitation of this vulnerability could allow an attacker to execute arbitrary code, leading to unauthorized access or a denial of service, which can disrupt network performance.
If you are using a version of iperf3 prior to 3.9-14.el9_7.1, your installation is vulnerable to this issue.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can check your application for this vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for iperf3.
