{"id":"SUSE-SU-2026:4678-1","summary":"Security update for iperf","details":"This update for iperf fixes the following issues:\n\n- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via\n  resource exhaustion (bsc#1284405).\n- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion\n  (bsc#1284404).\n- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-\n  test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).\n- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a\n  256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).\n- CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an\n  infinite loop (bsc#1283528).\n\nChanges for iperf:\n\n- Updated to version 3.22.\n","modified":"2026-10-15T18:00:06.423872963Z","published":"2026-10-15T07:27:34Z","related":["CVE-2026-101276","CVE-2026-101283","CVE-2026-102253","CVE-2026-71217","CVE-2026-71218"],"upstream":["CVE-2026-101276","CVE-2026-101283","CVE-2026-102253","CVE-2026-71217","CVE-2026-71218"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264678-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283528"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283786"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283787"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284404"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284405"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-101276"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-101283"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-102253"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-71217"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-71218"}],"affected":[{"package":{"name":"iperf","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","purl":"pkg:rpm/suse/iperf&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-150000.3.18.1"}]}],"ecosystem_specific":{"binaries":[{"iperf-devel":"3.22-150000.3.18.1","libiperf0":"3.22-150000.3.18.1","iperf":"3.22-150000.3.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4678-1.json"}},{"package":{"name":"iperf","ecosystem":"SUSE:Enterprise Storage 7.1","purl":"pkg:rpm/suse/iperf&distro=SUSE%20Enterprise%20Storage%207.1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-150000.3.18.1"}]}],"ecosystem_specific":{"binaries":[{"libiperf0":"3.22-150000.3.18.1","iperf":"3.22-150000.3.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4678-1.json"}}],"schema_version":"1.9.0"}