MGASA-2026-0539

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0539.html
Import Source
https://advisories.mageia.org/MGASA-2026-0539.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2026-0539
Upstream
CVE (5)
Published
2026-10-25T01:13:22Z
Modified
2026-10-25T01:28:00Z
Summary
Updated iperf package fixes security vulnerabilities
Details

Iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion. (CVE-2026-71217) Unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion. (CVE-2026-71218) Iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream. (CVE-2026-101276) Iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken. (CVE-2026-101283) Iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS. (CVE-2026-102253)

References
Credits

Affected packages

Mageia:10 / iperf

Package

Name
iperf
Purl
pkg:rpm/mageia/iperf?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.22-1.mga10

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0539.json"