CVE-2026-102253

Received Received - Intake

UDP DoS in iperf3 via Crafted Control-Channel Parameter

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-09-30

AI Q&A

2026-09-30

EPSS Evaluated

N/A

NVD

CVE-2026-102253

EUVD

EUVD-2026-89415

Affected Vendors & Products

Vendor	Product	Version / Range
iperf3	iperf3	to 3.22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

iperf3 versions before 3.22 have a denial of service flaw where unauthenticated remote attackers can crash the server's UDP receive worker into an infinite loop. This is done by sending a single crafted control message followed by a 16-byte UDP datagram, causing the server to use 100% CPU until forcibly killed.

Detection Guidance

To detect this vulnerability, monitor for iperf3 processes consuming 100% CPU indefinitely. Check for UDP traffic on the port iperf3 is running on (default 5201) and look for repeated control-channel parameter messages followed by 16-byte UDP datagrams. Use tools like netstat, ss, or tcpdump to inspect network traffic and process states.

Impact Analysis

This vulnerability can make the iperf3 server completely unresponsive, disrupting network performance testing and potentially affecting services relying on it. The server may become unusable until manually restarted, causing downtime.

Mitigation Strategies

Immediately upgrade iperf3 to version 3.22 or later. If upgrading is not possible, restrict access to the iperf3 server using firewalls or network segmentation to prevent unauthenticated remote attacks. Disable UDP testing if not required. Monitor affected systems for abnormal CPU usage and terminate unresponsive processes with SIGKILL if detected.

Hi! I’m here to help you understand CVE-2026-102253. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70