CVE-2023-38403
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
In iperf3 versions before 3.14, a vulnerability allows peers to cause an integer overflow and heap corruption via a crafted length field.
Risk Assessment
An attacker could exploit this vulnerability to destabilize the application or gain unauthorized access to memory.
Recommendation
It is recommended to update iperf3 to version 3.14 or later to mitigate this vulnerability.
Other vulnerabilities in iperf3
See all- CVE-2026-71218Medium
A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the JSON_read() function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.
- CVE-2026-71217High
A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.
Original NVD description (English source)
iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.