CVE-2026-101283

Name of the Vulnerable Software and Affected Versions iperf3 versions 3.20 through 3.21

Description A pre-authentication heap buffer overflow exists in the decrypt rsa message() function. This occurs because a 256-byte RSA buffer is read using a ciphertext length controlled by the attacker, allowing an unauthenticated client to overflow the heap by providing an oversized authtoken.

Recommendations Update iperf3 to version 3.22.