The vulnerability resides in iperf3's JSON_read function, where the message length supplied by a peer can be completely arbitrary. The function allocates a memory block directly based on that length without any upper bound, allowing an attacker to request an extremely large allocation. The resulting excessive memory consumption may force the iperf3 process to run out of available RAM, trigger severe slowdown, or terminate altogether, effectively producing a denial of service for any client depending on the service.

All Red Hat Enterprise Linux releases that ship with the affected iperf3 package (RHEL 7, 8, 9, 10) are impacted. No specific sub‑versions are listed in the CNA data, so any distribution using the current iperf3 binaries is considered vulnerable as long as the JSON_read implementation remains unchanged.

The CVSS score of 5.3 indicates a moderate severity. The EPSS value is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote, unauthenticated network connection to the iperf3 control port, where an attacker sends a crafted JSON message with an enormous length field. Because the malicious allocation occurs before authentication checks, the attacker need not possess any credentials or privileged access.