This vulnerability in iperf3 arises from improper input validation of numeric parameters in control-channel JSON messages. Specifically, parameters such as 'parallel' and 'len' are not properly checked for size limits, allowing a remote attacker to trigger excessive resource consumption through stream and thread creation and large buffer allocations. The consequence is resource exhaustion that causes a Denial of Service (DoS) on the affected iperf3 server running on Red Hat Enterprise Linux 10.

The vulnerability allows remote attackers to cause a Denial of Service (DoS) by exhausting server resources such as CPU and memory. There is no impact on confidentiality or integrity reported. The CVSS v3.1 score is 7.5 (high severity) with no privileges required, no user interaction, and network attack vector. The attack results in availability impact only.

No official patch or fix is currently confirmed for this vulnerability. The vendor advisory recommends mitigating the issue by restricting network access to the iperf3 server to trusted clients or networks using firewall rules. If iperf3 functionality is not needed, disabling the iperf3 service is advised. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71217 for updates.