CVE-2026-101276

Received Received - Intake

Heap Use-After-Free in iperf3

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: 98a01053-8a31-4f6d-9aa9-252be161adc6

Description

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-101276

Affected Vendors & Products

Vendor	Product	Version / Range
esnet	iperf3	to 3.22 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

iperf3 3.21 has a remote unauthenticated heap use-after-free flaw. The server's per-test watchdog function frees streams without stopping their worker threads. This causes blocked worker threads to dereference freed memory, leading to crashes or potential code execution.

Detection Guidance

This vulnerability involves a heap use-after-free in iperf3 3.21. Detection requires checking if the vulnerable version (3.21) is installed and running. Use commands like 'iperf3 --version' to verify the version. Monitor for crashes or abnormal behavior in iperf3 server processes during active tests.

Impact Analysis

An attacker could exploit this to crash the iperf3 server remotely without authentication. This may cause denial of service or, in some cases, allow arbitrary code execution on the server system running iperf3 3.21.

Compliance Impact

This vulnerability could lead to service disruption or unauthorized access, potentially violating availability and security requirements in GDPR, HIPAA, and other standards. Organizations must patch to maintain compliance.

Mitigation Strategies

Upgrade iperf3 to version 3.22 or later immediately. Stop using version 3.21 to prevent exploitation. If upgrading is not possible, disable the iperf3 server service until patched.

Hi! I’m here to help you understand CVE-2026-101276. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70