CVE-2026-102253

Name	CVE-2026-102253
Description	iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1149699

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
iperf3 (PTS)	bookworm	3.12-1+deb12u2	fixed
	bookworm (security)	3.12-1+deb12u1	fixed
	trixie	3.18-2+deb13u2	vulnerable
	forky, sid	3.22-0.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
iperf3	source	bookworm	(not affected)
iperf3	source	(unstable)	3.22-0.1			1149699

Notes

[trixie] - iperf3 <no-dsa> (Minor issue)
[bookworm] - iperf3 <not-affected> (Vulnerable UDP per-datagram loop introduced in 3.21)
https://github.com/esnet/iperf/commit/a25378f8cbbaa7b3db5674ca3dcc19658ae65da3 (3.22)
https://github.com/esnet/iperf/releases/tag/3.22