External risk intelligence

iperf3 Heap Buffer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-101283

iperf3 is a network bandwidth measurement tool commonly used for internal network testing and performance troubleshooting. While it can be configured to listen on public interfaces, it is typically deployed within controlled internal environments or local area networks for diagnostic purposes rather than as a public-facing service.

Buffer Overflow

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in iperf3 software that could allow an unauthenticated client to remotely trigger a heap buffer overflow. This type of issue can sometimes lead to disruption of services or unauthorized access to systems. The main concern is confirming whether this software is used within the organization and if it is exposed to potential attackers.

Unauthenticated overflow in network testing tool.
Confirm relevance and exposure of this tool.
Understand potential impact to network testing.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit a heap buffer overflow vulnerability in iperf3 by sending a crafted authtoken. This could allow them to overwrite memory on the target system, potentially leading to code execution.

Vulnerable to unauthenticated network access.
Triggered by sending an oversized authtoken.
Risk of heap corruption and code execution.

Live Threat

Current exploitation, exposure, and threat context

The pre-authentication heap buffer overflow in iperf3 could allow an unauthenticated client to overflow the heap when sending an oversized authtoken, potentially impacting the availability and integrity of the iperf3 service.

Service availability and integrity.
An unauthenticated client could exploit this.
Denial of service or remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this pre-authentication heap buffer overflow in iperf3, the platform or infrastructure teams are likely responsible for identifying its presence. The first critical step is to locate all instances of the affected iperf3 versions, assess their network exposure and business criticality, and then determine the specific owner for remediation planning.

Identify iperf3 instances and owners.
Verify network reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is iperf3 and why is it used?

iperf3 is a widely used open-source command-line tool designed for active measurements of the maximum achievable bandwidth on IP networks. Network engineers and system administrators rely on it for tuning network performance, troubleshooting connectivity issues, and testing throughput between endpoints in data centers or across local area networks.

What is the vulnerability in CVE-2026-101283?

This CVE involves a heap-based buffer overflow, categorized as CWE-122. It occurs because the software fails to properly restrict the size of data during an RSA decryption operation. Specifically, an attacker can provide an oversized authentication token that exceeds the memory space allocated for it, potentially corrupting the heap and causing the service to crash or behave unexpectedly.

How is this iperf3 heap overflow triggered?

The vulnerability is triggered when an unauthenticated client sends a specially crafted, oversized authentication token to an iperf3 server. It is important to note that sending a correctly formatted, standard-sized token will not trigger this memory corruption issue; the flaw specifically requires the submission of malformed data that exceeds the 256-byte buffer limit during the decryption process.

Is my network at risk from this iperf3 flaw?

According to Halo Surface Signal, risk depends on how you deploy the tool. While iperf3 is frequently used for internal performance testing, it may be reachable if configured to listen on public-facing interfaces. If you run iperf3 instances that are accessible from untrusted networks or the internet, your system is at higher risk of receiving malicious traffic compared to those confined to private, controlled segments.

How do I respond to CVE-2026-101283?

The first step is to perform an inventory to locate all active instances of iperf3 within your environment and identify their versions. For any systems identified, verify if they are running the affected versions 3.20 or 3.21. Once mapped, coordinate with your infrastructure teams to prioritize updating those instances to version 3.22, which includes the fix for this buffer overflow issue.

References

newreleases.io/project/github/esnet/iperf/release/3.22

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.