{"id":"openSUSE-SU-2026:22090-1","summary":"Security update for iperf","details":"This update for iperf fixes the following issues:\n\n- CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via\n  resource exhaustion (bsc#1284405).\n- CVE-2026-71218: unbounded peer-controlled allocation in JSON_read() allows unauthenticated remote memory exhaustion\n  (bsc#1284404).\n- CVE-2026-101276: iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-\n  test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads (bsc#1283786).\n- CVE-2026-101283: iperf3 3.20--3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a\n  256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (bsc#1283787).\n- CVE-2026-102253: missing checks in the server's UDP receive worker allows unauthenticated remote attackers to cause an\n  infinite loop (bsc#1283528).\n\nChanges for iperf:\n\n- Updated to version 3.22\n","modified":"2026-10-19T17:23:13.585480674Z","published":"2026-10-12T12:12:10Z","related":["CVE-2026-101276","CVE-2026-101283","CVE-2026-102253","CVE-2026-71217","CVE-2026-71218"],"upstream":["CVE-2026-101276","CVE-2026-101283","CVE-2026-102253","CVE-2026-71217","CVE-2026-71218"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283528"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283786"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283787"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284404"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284405"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-101276"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-101283"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-102253"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-71217"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-71218"}],"affected":[{"package":{"name":"iperf","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/iperf&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"iperf":"3.21-160000.1.1","iperf-devel":"3.21-160000.1.1","libiperf0":"3.21-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22090-1.json"}}],"schema_version":"1.9.0"}