CVE-2026-71217
Received Received - Intake

Resource Exhaustion in iperf3 via Crafted JSON

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Red Hat, Inc.

Description
A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-71217
EUVD
EUVD-2026-55990

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
iperf3 iperf3 *
iperf3 iperf3 From 3.17.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in iperf3, a network performance testing tool. A remote attacker can send crafted JSON data with oversized numeric parameters like 'parallel' and 'len' to the server. The server does not properly validate these inputs, leading to excessive stream creation, thread generation, and large buffer allocations. This causes resource exhaustion and results in a Denial of Service (DoS) on the affected iperf3 server.

Detection Guidance

Monitor iperf3 server logs for unusual activity such as excessive stream creation or high resource usage. Check for incoming JSON control-channel requests with abnormally large values for parameters like 'parallel' or 'len'.

Impact Analysis

If you run an iperf3 server, an attacker could exploit this to crash your service by consuming all available system resources. This would make the server unavailable for legitimate users, disrupting network performance testing and any dependent services. The attack requires no authentication and can be executed remotely over the network.

Compliance Impact

This vulnerability could lead to service disruptions, which may violate availability requirements in GDPR and HIPAA. For GDPR, prolonged downtime could impact data processing operations, while HIPAA requires availability of critical systems. Exploitation could result in non-compliance due to service unavailability.

Mitigation Strategies
  • Restrict network access to the iperf3 server to trusted clients only.
  • Disable the iperf3 service if it is not actively used.
  • Apply firewall rules to block unauthorized control-channel JSON requests with oversized parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71217. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart