CVE catalog

CVE-2024-53580

iperf3 vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.92% · Oct 25, 2026

A flaw was found in iperf. This vulnerability allows a Denial of Service (DoS) via the injection of malformed JSON data, which can result in a segmentation fault when a NULL pointer is passed to strdup(). iperf: Denial of Service in iperf Due to Improper JSON Handling This vulnerability marked as important severity rather than moderate due to its potential to cause a complete denial of service (DoS) by exploiting a segmentation fault through malformed JSON data. The flaw stems from improper input validation, which allows attackers to crash the server by sending invalid data that triggers memory mismanagement. Since iperf is widely used in performance testing of network systems, a DoS attack could disrupt critical operations in production environments, leading to service outages or performance degradation in large-scale networks. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianiperf3sid3.22-0.1fixed
Debianiperf3forky3.22-0.1fixed
Debianiperf3trixie3.18-2+deb13u2fixed
Debianiperf3bookworm3.12-1+deb12u2vulnerable
Debianiperf3bookworm-security3.12-1+deb12u1vulnerable
Ubuntuiperf3nobleNot reportedvulnerable
Ubuntuiperf3noble3.16-1ubuntu0.1~esm1fixed
Ubuntulibiperf-devnoble3.16-1ubuntu0.1~esm1fixed
Ubuntulibiperf0noble3.16-1ubuntu0.1~esm1fixed
Opensuseiperftumbleweed3.18-1.1fixed
Suseiperflinux enterprise module for package hub 15 sp63.18-150000.3.12.1fixed
Suseiperfenterprise storage 7.13.18-150000.3.12.1fixed
Opensuseiperfleap 15.63.18-150000.3.12.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianiperf3sourcesid3.18-1not yet assignedNot reported[1090931]
Debianiperf3sourceforky3.18-1not yet assignedNot reported[1090931]
Debianiperf3sourcetrixie3.18-1not yet assignedNot reported[1090931]
Debianiperf3sourcebookworm(unfixed)not yet assignedNot reported[1090931]
Ubuntuiperf3debnoble3.16-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibiperf-devdebnoble3.16-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibiperf0debnoble3.16-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Opensuseiperfrpmtumbleweed3.18-1.1Not reportedOPENSUSE-SU-2025:14700-1Not reported
Suseiperfrpmlinux enterprise module for package hub 15 sp63.18-150000.3.12.1Not reportedSUSE-SU-2025:0291-1Not reported
Suseiperfrpmenterprise storage 7.13.18-150000.3.12.1Not reportedSUSE-SU-2025:0291-1Not reported
Opensuseiperfrpmleap 15.63.18-150000.3.12.1Not reportedSUSE-SU-2025:0291-1Not reported

[Debian bug #1090931]

Notes

[bookworm] iperf3: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [iperf3]Affected
    Details (4)

    • 3.12-1+deb12u2 · amd64 · bookworm

      Affected

      usn · iperf3 · debian · bookworm; usn · iperf3 · debian · 12

    • 3.12-1+deb12u2 · arm64 · bookworm

      Affected

      usn · iperf3 · debian · bookworm; usn · iperf3 · debian · 12

    • 3.12-1+deb12u1 · amd64 · bookworm-security

      Affected

      usn · iperf3 · debian · bookworm; usn · iperf3 · debian · 12

    • 3.12-1+deb12u1 · arm64 · bookworm-security

      Affected

      usn · iperf3 · debian · bookworm; usn · iperf3 · debian · 12

  • [libiperf0]Affected

    Source package: [iperf3]

    Details (4)

    • 3.12-1+deb12u2 · amd64 · bookworm

      Affected

      usn · iperf3 · debian · bookworm; usn · iperf3 · debian · 12

    • 3.12-1+deb12u2 · arm64 · bookworm

      Affected

      usn · iperf3 · debian · bookworm; usn · iperf3 · debian · 12

    • 3.12-1+deb12u1 · amd64 · bookworm-security

      Affected

      usn · iperf3 · debian · bookworm; usn · iperf3 · debian · 12

    • 3.12-1+deb12u1 · arm64 · bookworm-security

      Affected

      usn · iperf3 · debian · bookworm; usn · iperf3 · debian · 12

  • [libiperf-dev]Affected

    Source package: [iperf3]

    Details (4)

    • 3.12-1+deb12u2 · amd64 · bookworm

      Affected

      usn · iperf3 · debian · bookworm; usn · iperf3 · debian · 12

    • 3.12-1+deb12u2 · arm64 · bookworm

      Affected

      usn · iperf3 · debian · bookworm; usn · iperf3 · debian · 12

    • 3.12-1+deb12u1 · amd64 · bookworm-security

      Affected

      usn · iperf3 · debian · bookworm; usn · iperf3 · debian · 12

    • 3.12-1+deb12u1 · arm64 · bookworm-security

      Affected

      usn · iperf3 · debian · bookworm; usn · iperf3 · debian · 12

[openSUSE Tumbleweed]

  • [iperf-devel]Unknown

    Source package: [iperf]

    Details (1)

    • 3.21-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 3.18-1.1

      Version impact unknown

      usn · iperf · opensuse · tumbleweed

  • [libiperf0]Unknown

    Source package: [iperf]

    Details (1)

    • 3.21-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 3.18-1.1

      Version impact unknown

      usn · iperf · opensuse · tumbleweed

  • [iperf]Fixed

    Source package: [iperf]

    Details (1)

    • 3.21-1.4 · x86_64 · tumbleweed

      Fixed · Fixed: 3.18-1.1

      usn · iperf · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [iperf3]Fixed
    Details (2)

    • 3.18-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 3.18-1

      usn · iperf3 · debian · 13

    • 3.18-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 3.18-1

      usn · iperf3 · debian · 13

  • [libiperf0]Fixed

    Source package: [iperf3]

    Details (2)

    • 3.18-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 3.18-1

      usn · iperf3 · debian · 13

    • 3.18-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 3.18-1

      usn · iperf3 · debian · 13

  • [libiperf-dev]Fixed

    Source package: [iperf3]

    Details (2)

    • 3.18-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 3.18-1

      usn · iperf3 · debian · 13

    • 3.18-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 3.18-1

      usn · iperf3 · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]