A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric… (CVE-2026-71217)

The iperf3 server improperly validates numeric parameters in control-channel JSON messages, such as 'parallel' and 'len'. A remote attacker can exploit this by sending crafted JSON with oversized numeric values, causing excessive stream and thread creation and large buffer allocations. This leads to resource exhaustion and denial of service (DoS) on the iperf3 server. The vulnerability is tracked as CVE-2026-71217 with a CVSS v3.1 base score of 7.5 (high severity). Red Hat has issued security advisories and patches for affected versions of iperf3 in Red Hat Enterprise Linux 8, including various architectures and extended life cycle releases.

Successful exploitation results in denial of service due to resource exhaustion on the iperf3 server. There is no impact on confidentiality or integrity reported. The attack requires no privileges or user interaction and can be performed remotely over the network.

Red Hat has released official patches for iperf3 in Red Hat Enterprise Linux 8 and its extended life cycle versions. Applying these updates will remediate the vulnerability. Additionally, restricting network access to the iperf3 server to trusted clients or networks using firewall rules can mitigate the risk. If iperf3 functionality is not required, disabling the iperf3 service is recommended.