Description

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T09:17:14.057Z",
  "pubdate": "2026-08-11T09:17:14.057Z",
  "executiveSummary": "A vulnerability has been identified in iperf3 involving improper input validation within the control-channel JSON parsing mechanism. Specifically, remote attackers can exploit this flaw by transmitting crafted control-channel JSON payloads containing oversized numeric parameters, such as parallel and len. The lack of robust boundary checking and validation on these parameters by the server leads to uncontrolled resource consumption.\nThe primary impact of this vulnerability is a Denial of Service (DoS) affecting the iperf3 server. When processed, the malicious numeric parameters induce excessive stream and thread creation alongside massive buffer allocations, rapidly exhausting available system resources such as memory and CPU cycles. Consequently, the affected server becomes unresponsive or crashes, disrupting network performance testing operations.\nThe affected product is iperf3. The risk implication is significant for environments relying on accessible iperf3 servers, as the exploitation capabilities require only remote network access to the server port without necessitating prior authentication or elevated privileges.\nExploitation requirements are minimal, relying strictly on the ability of a remote attacker to establish a network connection to the target iperf3 server and transmit maliciously crafted JSON control data during the initialization phase of a test session.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient validation and sanitization of numeric parameters transmitted via the control-channel JSON within iperf3. The vulnerable component fails to enforce upper bounds or sanity checks on critical variables such as parallel and len before utilizing them in core operational logic.\nThe attack vector involves network exposure of the iperf3 server, typically listening on TCP port 5201. Authentication requirements are absent by default, and privilege requirements are minimal, as the service generally operates with standard user privileges depending on the host configuration.\nThe attack flow proceeds as follows: First, a remote attacker establishes a TCP connection to the target iperf3 server. Second, the attacker initiates the test control channel and transmits a maliciously crafted JSON payload containing excessively large values for parameters like parallel (specifying the number of simultaneous streams) and len (specifying buffer lengths). Third, the iperf3 server parses the incoming JSON control data without validating the numerical ranges against system resource constraints.\nUpon processing the oversized parameters, the application attempts to allocate memory buffers proportional to the specified len and spawns threads or streams corresponding to the oversized parallel value. This payload behavior results in rapid exhaustion of heap memory, file descriptors, and CPU scheduler resources. The resulting resource exhaustion precipitates a Denial of Service condition, crashing the iperf3 server process or rendering it incapable of servicing legitimate testing requests.\nPost-exploitation impact is limited to service availability disruption, as the vulnerability does not inherently provide remote code execution, privilege escalation, or unauthorized data access based on the provided vulnerability description."
}