Description

A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-11T09:17:14.200Z",
  "pubdate": "2026-08-11T09:17:14.200Z",
  "executiveSummary": "A vulnerability has been identified in iperf3 involving the JSON_read() function, categorized as an uncontrolled memory allocation flaw leading to a Denial of Service (DoS). The security defect allows a remote, unauthenticated attacker to exploit the message parsing logic by supplying a peer-controlled message length that lacks proper upper bound validation.\nUpon receiving a crafted message, the affected system dynamically allocates memory proportional to the attacker-controlled length, causing excessive resource consumption. This results in memory exhaustion, severe performance degradation, or the abrupt termination of the iperf3 service, effectively disrupting network testing operations.\nThe risk implication is high for environments relying on continuous availability of iperf3 instances, as attackers require no prior authentication or elevated privileges to trigger the fault. Exploitation is network-based, targeting exposed iperf3 daemons listening for incoming connections and peer messages.",
  "technicalDetails": "The root cause of the vulnerability resides in the input validation failure within the JSON_read() function of iperf3. When processing incoming communications, the function accepts a peer-controlled message length parameter directly from the network stream without enforcing maximum size boundaries or validation checks prior to heap allocation.\nThe vulnerable component is the message ingestion and parsing subsystem, specifically the memory allocation routines handling incoming JSON payloads. The affected product is iperf3, across configurations where the service accepts remote connections and processes peer-controlled JSON data structures.\nRegarding attack prerequisites, the vulnerability requires network exposure of the iperf3 service, typically listening on TCP port 5201 by default. The attacker requires no authentication, no prior privileges, and interacts directly with the service over the network protocol.\nThe step-by-step attack flow proceeds as follows: First, the remote unauthenticated attacker establishes a network connection to the target iperf3 service. Second, the attacker sends a malicious payload where the header or control message specifies an excessively large message length parameter destined for the JSON_read() function. Third, the application trusts the peer-controlled length and issues a dynamic memory allocation request matching the specified magnitude without validating if sufficient resources exist or if the size exceeds expected protocol limits. Fourth, the system attempts to allocate the requested memory block, rapidly depleting available system RAM or virtual memory. Finally, the operating system's Out-Of-Memory (OOM) killer intervenes or the application crashes due to allocation failure, leading to service termination and a complete Denial of Service.\nThe payload behavior focuses entirely on resource exhaustion rather than arbitrary code execution. The post-exploitation impact is limited to service disruption, hanging, or crashing of the iperf3 daemon, preventing legitimate network performance measurements until the service is manually restarted."
}