CVE-2026-102253

Name of the Vulnerable Software and Affected Versions iperf3 versions prior to 3.22

Description A denial of service issue allows unauthenticated remote attackers to cause the server's UDP receive worker to enter an unrecoverable infinite loop. This is achieved by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. The attack can pin the affected per-stream receive thread at approximately 100% CPU usage, making the server unusable until the process is forcibly terminated with SIGKILL, as it fails to respond to normal control-channel closure.

Recommendations Update to version 3.22 or later.