Description
iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.
Published: 2026-09-30
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a heap use‑after‑free that occurs when the iperf3 server’s watchdog thread releases a stream object without terminating the associated worker thread. An unauthenticated remote client can trigger this condition, leading to a dereference of freed memory that may allow arbitrary code execution or a denial of service.

Affected Systems

This flaw affects the Esnet iperf3 server at version 3.21. The vulnerability is resolved in iperf3 3.22, which removes the improper deallocation in server_timer_proc.

Risk and Exploitability

The CVSS base score is 9.2, placing the issue in the critical range. No EPSS score is available; the vulnerability is not yet in CISA’s KEV catalog. Because the service is exposed to untrusted clients, the attack vector is network‑based and does not require authentication, making the exploit likely to succeed against vulnerable instances.

Generated by OpenCVE AI on September 30, 2026 at 22:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to iperf3 version 3.22 or newer.
  • If an upgrade cannot be performed, restrict the iperf3 service to trusted hosts or place it behind a firewall that limits exposure to the public network.
  • Monitor the service for crashes or anomalous memory usage and apply general best‑practice hardening such as disabling unused features or running the process with restricted privileges.

Generated by OpenCVE AI on September 30, 2026 at 22:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Es
Es iperf3
Vendors & Products Es
Es iperf3

Wed, 30 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
Title Remote unauthenticated heap use‑after‑free in iperf3 3.21

Wed, 30 Sep 2026 21:15:00 +0000

Type Values Removed Values Added
Description iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.
Weaknesses CWE-416
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Es Iperf3
cve-icon MITRE

Status: PUBLISHED

Assigner: Anthropic

Published:

Updated: 2026-10-01T15:51:00.728Z

Reserved: 2026-09-28T11:52:18.066Z

Link: CVE-2026-101276

cve-icon Vulnrichment

Updated: 2026-10-01T15:50:56.464Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T21:16:54.913

Modified: 2026-10-01T16:17:32.020

Link: CVE-2026-101276

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T15:30:08Z

Weaknesses