CVE-2023-38403

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-38403
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-38403.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-38403
Downstream
ALPINE (1)
AZL (1)
BELL (1)
DEBIAN (1)
JLSEC (1)
MGASA (1)
OESA (1)
openSUSE (1)
RHSA (8)
RLSA (2)
SUSE (2)
UBUNTU (1)
Related
ALSA (2)
openSUSE (1)
SUSE (2)
Published
2023-07-17T00:00:00Z
Modified
2026-10-22T15:57:07Z
Summary
[none]
Details

iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38403.json"
}
References

Affected packages

Git / github.com/esnet/iperf

Affected ranges

Type
GIT
Repo
https://github.com/esnet/iperf
Events
Introduced
6f6716aed146d5e2293f94b2ac44f6189f2ccd27
Fixed
a0be85934144bc04712a6695b14ea6e45c379e1d
Fixed
0ef151550d96cc4460f98832df84b4a1e87c65e9
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3"
                },
                {
                    "fixed": "3.14"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "fixed": "0ef151550d96cc4460f98832df84b4a1e87c65e9"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.0-ALPHA1
3.0-BETA1
3.0-BETA2
3.0-BETA3
3.0-BETA4
3.0-BETA5
3.0.1
3.0.4
3.1
3.10
3.10.1
3.11
3.12
3.13
3.1b1
3.1b2
3.1b3
3.2
3.2rc1
3.3
3.4
3.5
3.6
3.7
3.8
3.8.1
3.9
Other
iperf3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-38403.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "31138989934835967853644463147944633206",
                "300129804459515635418185354063148005800",
                "211185849642239104369431138118764752128",
                "120289198626001640135016292307456648609",
                "103946030697011972946752526404262707110",
                "74265392440462843323174286899530357374",
                "317375933644696769020399486204161531528",
                "286784827784628466018746909541478291355",
                "44075911177452260091104907090409103549",
                "252582931826044103934091042691051999819",
                "260211622875497584537767243227104153086",
                "334182649030972681018623345589886499362"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-38403-2f181cff",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/esnet/iperf/commit/0ef151550d96cc4460f98832df84b4a1e87c65e9",
        "target": {
            "file": "src/iperf_api.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "4224136192845182230612297700002105072",
            "length": 534
        },
        "id": "CVE-2023-38403-b779251d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/esnet/iperf/commit/0ef151550d96cc4460f98832df84b4a1e87c65e9",
        "target": {
            "file": "src/iperf_api.c",
            "function": "JSON_read"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T15:57:07Z"