A crafted control‑channel parameter message followed by a single 16‑byte UDP datagram can trigger an infinite loop in the UDP receive worker of iperf3 versions earlier than 3.22. An unauthenticated remote attacker can cause the per‑stream receive thread to run at 100 % CPU indefinitely, preventing normal shutdown and rendering the server unusable until it is forcibly terminated. The vulnerability is a classic loop‑control flaw, classified as CWE‑835.

The affected product is esnet’s iperf3, specifically any release prior to 3.22. No other vendors or product versions are reported to be impacted.

The vulnerability has a CVSS score of 8.7, indicating high severity, and is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the EPSS score is unavailable, the exact exploitation probability is not quantified, but the impact is clear: any host running a vulnerable iperf3 instance exposed to untrusted traffic can be rendered inoperable by an attacker without authentication. The attack vector is remote, over the network, and does not require prior access rights.