CVE-2026-102253: iperf3 Denial of Service Vulnerability

CVE-2026-102253 Overview

CVE-2026-102253 is a denial of service vulnerability in iperf3 versions prior to 3.22. Unauthenticated remote attackers can pin the server's UDP receive worker thread into an unrecoverable infinite loop. Exploitation requires only a single crafted control-channel parameter message followed by one 16-byte UDP datagram. The affected per-stream receive thread runs at approximately 100% CPU indefinitely. The process does not respond to normal control-channel closure and must be terminated with SIGKILL. The vulnerability is tracked under CWE-835 (Loop with Unreachable Exit Condition).

Critical Impact
A single crafted control message and one 16-byte UDP datagram permanently disable the iperf3 server, requiring forced termination to recover.

Affected Products

iperf3 versions prior to 3.22
ESnet iperf3 network performance measurement tool
Systems running iperf3 servers exposed to untrusted networks

Discovery Timeline

2026-09-29 - CVE-2026-102253 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102253

Vulnerability Analysis

The vulnerability resides in the UDP receive worker path of the iperf3 server. An attacker establishes a normal control-channel connection and sends a crafted parameter message that configures the server's per-stream UDP receive thread. A single 16-byte UDP datagram then triggers an unrecoverable infinite loop in that thread.

The affected thread consumes roughly 100% CPU on one core for the duration of the loop. Because the loop never returns to the server's control-channel dispatcher, the process ignores standard client-initiated session teardown. Operators must issue SIGKILL to reclaim the resources.

The attack is unauthenticated, network-reachable, and requires no user interaction. Any iperf3 server reachable by an attacker on its listening TCP control port and UDP data port can be disabled with minimal traffic.

Root Cause

The root cause is a missing exit condition in the UDP receive loop when specific parameter combinations are supplied through the control channel. The worker fails to validate the interaction between the configured stream parameters and the incoming datagram size, resulting in a condition where the loop's termination check is never satisfied (CWE-835).

Attack Vector

Exploitation proceeds over the network across two channels. First, the attacker opens a TCP connection to the iperf3 server's control port and negotiates a session with the malicious parameter message. Second, the attacker sends one 16-byte UDP datagram to the corresponding data port. The receive worker enters the infinite loop immediately upon processing that datagram.

No authentication, credentials, or elevated privileges are required. The vulnerability's impact is limited to availability. Confidentiality and integrity are not affected. See the VulnCheck Security Advisory for full technical details.

Detection Methods for CVE-2026-102253

Indicators of Compromise

An iperf3 process consuming sustained ~100% CPU on a single core after receiving external UDP traffic
iperf3 sessions that fail to terminate cleanly and require SIGKILL to remove
Short-lived TCP control-channel connections to the iperf3 port immediately followed by a single small UDP datagram from the same source

Detection Strategies

Monitor process CPU utilization for iperf3 workers and alert when a single thread remains at ~100% CPU beyond expected test durations
Inspect network flow records for connections that establish an iperf3 control channel and then transmit only one 16-byte UDP packet
Track SIGKILL events targeting iperf3 processes as a post-exploitation recovery signal

Monitoring Recommendations

Enable per-process CPU and thread telemetry on hosts running iperf3, especially internet-exposed instances
Log all connections to the iperf3 control port with source IP, timestamp, and session duration for correlation
Alert on repeated short iperf3 sessions from the same source, which may indicate scripted exploitation attempts

How to Mitigate CVE-2026-102253

Immediate Actions Required

Upgrade iperf3 to version 3.22 or later on all affected hosts
Restrict access to the iperf3 control and data ports to trusted management networks using host or network firewalls
Stop and disable any iperf3 server instances that are not required for active testing

Patch Information

The fix is included in iperf3 3.22, published by ESnet. Refer to the GitHub Release Tag 3.22 and the GitHub Release Notes for the full changelog and download links. Administrators should rebuild or update packages from their distribution once the patched version is available.

Workarounds

Bind iperf3 to a loopback or management-only interface using the -B option when public exposure is not required
Front the iperf3 listener with firewall rules that permit connections only from authorized source addresses
Run iperf3 on-demand rather than as a persistent service to minimize the exposure window

bash

# Configuration example: restrict iperf3 to a management interface and firewall its ports
iperf3 --server --bind 10.0.0.10 --port 5201 --daemon

# Example nftables rules limiting iperf3 access to a trusted subnet
nft add rule inet filter input ip saddr != 10.0.0.0/24 tcp dport 5201 drop
nft add rule inet filter input ip saddr != 10.0.0.0/24 udp dport 5201 drop