CVE-2026-71217

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71217
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71217.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71217
Downstream
Published
2026-08-11T08:50:10.140Z
Modified
2026-08-13T08:06:41.343315Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion
Details

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.

Database specific 
{
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71217.json",
    "cna_assigner": "redhat"
}
References

Affected packages

Git / github.com/esnet/iperf

Affected ranges

Type
GIT
Repo
https://github.com/esnet/iperf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
494dd377eca4689672becdf06a85158557db1586
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

2.*
2.0-RELEASE
2.0.1-RELEASE
2.0.2-RELEASE
2.0.3-RELEASE
2.0.4-RELEASE
3.*
3.0-ALPHA1
3.0-BETA1
3.0-BETA2
3.0-BETA3
3.0-BETA4
3.0-BETA5
3.0.1
3.0.4
3.1
3.10
3.10.1
3.11
3.12
3.13
3.14
3.15
3.16
3.16-beta1
3.17.1
3.18
3.19
3.1b1
3.1b2
3.1b3
3.2
3.20
3.21
3.2rc1
3.3
3.4
3.5
3.6
3.7
3.8
3.8.1
3.9
iperf-3.*
iperf-3.0a1
Other
iperf3
trunk

Database specific

vanir_signatures_modified 
"2026-08-13T08:06:41Z"
vanir_signatures 
[
    {
        "id": "CVE-2026-71217-3c3119f6",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 6324.0,
            "function_hash": "103025360546791018506123635547113238435"
        },
        "source": "https://github.com/esnet/iperf/commit/494dd377eca4689672becdf06a85158557db1586",
        "target": {
            "function": "get_parameters",
            "file": "src/iperf_api.c"
        }
    },
    {
        "id": "CVE-2026-71217-c6d2caa2",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "181412756766557406613961847052063549254",
                "316178886760695410445125310491752207707",
                "283817775609820572855166240161872654712",
                "8004742427457165786232270028537034876",
                "14342034747770940282114828061084483775",
                "198970859888211696596208456435468804507",
                "277744075145560961171862092101195347374",
                "143389788567679367788629952765724361766",
                "60508279048053298899140120860162030160",
                "281293055797531128653504854418782285359",
                "113683539234835500533503440402624729790",
                "263269078588656611152108961393500142551",
                "201729845273710056267077557970244933255",
                "57285294930675743227983389485042379387",
                "282102911081794884339616629616338288790",
                "290413921804449726943995930388182645002",
                "81730925219456142732323942880310300296",
                "216944196326028785179127954274114060949",
                "284594090892042051482645297851588972538",
                "331344725955557579820062178263743566158",
                "62094782440310499759852946838387442238",
                "86422330567179430397348171735815768599",
                "80114900762019881246737374271775332236",
                "80915346787063919467768364304604463303",
                "207988343694083697823350692865634955463",
                "300122963415932913628178403605159300762",
                "22993068445122083683507254313412333361",
                "97592269354167430853376696030391590945",
                "207988343694083697823350692865634955463",
                "300122963415932913628178403605159300762",
                "157137686231309448843736398647367116773",
                "335787359937888436170913939183089316054",
                "207988343694083697823350692865634955463",
                "300122963415932913628178403605159300762",
                "121384934779234426514344713913866960529",
                "205874161988892620978040784577825873888",
                "312983643018885298757947176873123338476",
                "235987457403868915447427521357614618143",
                "250329773298628889858834654146434744833",
                "167150991615171579764126403813149874515",
                "87226529483881243696276518486587177977",
                "302917485846554731031035375508527433046",
                "118940943163628771069748806287767745985",
                "213658395835573794180857846030345211400",
                "98315161488770404561909904203376519063",
                "266403496251470844848834813743741692698",
                "199207599978613293491101818164968075201",
                "337930645289230251189160639326327219784",
                "83368646978414225772689620244248131640",
                "33296388739129916591999116580923499079",
                "207988343694083697823350692865634955463",
                "44244784357205068649072485036947683173",
                "314229241541517042678351590666976208179",
                "286467950898005044550107986600016019232",
                "276382755786733125865424648111321414207",
                "207988343694083697823350692865634955463",
                "300122963415932913628178403605159300762",
                "229757517479385354159986599266557883515",
                "241007547143950742943307137800508416487",
                "338475258397113008962661570981399259190",
                "157340733319775094687774088634058709984",
                "168633411155283398904344007302946198030",
                "207988343694083697823350692865634955463",
                "300122963415932913628178403605159300762",
                "128150762634522466601489145208091238444",
                "333434389873589928767009254732866369353",
                "323181214860577320567503441047363721908",
                "140329831316119688688472152340162065978",
                "269072482555895836183363776607245295598",
                "231554709923743816595050795232994446360",
                "10810782133480687940902445892177658646",
                "268923499646322400793653762500753260528",
                "174167132373414886420769551758848985734",
                "246278723171754812753360000938026728085",
                "114322930202809735965497646778070168056",
                "188653588698711402765187933237751602199",
                "69476177073454583432648345436846832260",
                "228750450899494139111698087731448609012",
                "10266985309519963931088591373746550010",
                "305653491541846409548483404700678586422",
                "211115819023341818807633777059083180174",
                "320709173437960923949213534871419252938",
                "57080681887900061320943088932979397592",
                "100745113431958773669632698582671127257",
                "236170774185116382967879424217022337165",
                "266484953606754701459562085550807371105",
                "237907456299250898421165176794210020267",
                "229974365253714854584940742347890967003",
                "155241509384899998962723864371839822171",
                "155621502273811142932790036853521612677",
                "188111170933818323091055855420632887201",
                "288133352747867246804351605187298457579",
                "141083790463724561325984383731405887121",
                "167698258262890657634409496521701683795",
                "277216973648303819162159590417535968382",
                "29079482681278124773590973340244294312",
                "117698854628872785016169494152471946161",
                "53613394165054299720850881570155035250",
                "300607274769943885971842238225578033129",
                "248230633540113319096293434709882310713",
                "136264993756014457977634267702217962079",
                "79364342082656133987478824191326872270",
                "50730408100772357356876047853917129568",
                "14546360217625530225158740719179915216",
                "135794708292670810379741875977232422817",
                "236399762731068334869097447119497735901",
                "22869856503836120969880734755643674626",
                "321657795781172125763998816717633357636",
                "200157339589736219915267425751775096917",
                "324544887284420173269525771899241212537",
                "328933314477221612764992952496337830409",
                "42300294906943862702683260002601316116",
                "236261882023006258699633900127336006570",
                "130233182775853735803242125073088419255",
                "152142467557875397310221097365871157349",
                "169275139694331357601102224134082378307",
                "55913442221524877806582414284021420875",
                "220790273480005565327556246024273615747",
                "17072218818403613762377511959506148623",
                "83587284817742436610454337659114721432",
                "265805130695150256394002700838087752707",
                "283801185467390415022139194353774972755",
                "3473099551235522843672571266097267878",
                "338265513199993370893074886614393314881",
                "302154356710636600875013708120702847055",
                "217147324700502035799061307709661010070",
                "44802751828850760277043971253856599690",
                "249141532434943811595605987679896014446",
                "57191450823333288435006682197411570181",
                "218465683441435180023402709746316639197",
                "95183345734432633252607109303387803852",
                "177212928868951210693682989548899268132",
                "303934258092460828214241209944031419617",
                "195450724272119691550832922388766958064",
                "3384293008299910250232741248882165706",
                "58996158322429976325041275647891713328",
                "59670958481966239086648743926299546723",
                "26040777811565188259274472152460217658",
                "289254719187013897128530964921018900394",
                "133961202893726180620117849223233019626",
                "337043673404765130577595510343574895633",
                "143007755703290785165566594287145713890",
                "103712506125241860478723094886422447516",
                "229033055107188092652929470879236978466",
                "169829845078065371838271400656059754500",
                "279266163846988364688769645544736084066",
                "127886058585011931341447640518115810322",
                "214431652430816891564570696001298628879",
                "119420973903324208743036605753773046431",
                "6399337485819791098960528818382014886",
                "224327509933084816162729547245650544831",
                "255176163710804406422154161438120440032",
                "303646743596214321495874413322891830915",
                "253085238073555856445888669246393506628",
                "158947993474566621499176439489699599610",
                "249341933009667883227125025671439739983",
                "10810782133480687940902445892177658646",
                "150480273720287655435419807330057999090",
                "283147771461023702848451374426783083469",
                "13671044281188577113596627164340235084"
            ]
        },
        "source": "https://github.com/esnet/iperf/commit/494dd377eca4689672becdf06a85158557db1586",
        "target": {
            "file": "src/iperf_api.c"
        }
    },
    {
        "id": "CVE-2026-71217-db3e3110",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 23273.0,
            "function_hash": "161413016415223413905491677975764999833"
        },
        "source": "https://github.com/esnet/iperf/commit/494dd377eca4689672becdf06a85158557db1586",
        "target": {
            "function": "iperf_parse_arguments",
            "file": "src/iperf_api.c"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71217.json"