The vulnerability CVE-2026-71218 affects iperf3 in Red Hat Enterprise Linux 10. The JSON_read() function processes a peer-controlled message length and allocates memory without an upper bound, enabling a remote unauthenticated attacker to trigger excessive memory allocation. This can cause denial of service by exhausting system memory, severely slowing down or terminating the iperf3 service. The CVSS v3.1 base score is 5.3 (medium severity) with an attack vector of network, low attack complexity, no privileges or user interaction required, and an availability impact classified as low. Red Hat's advisory recommends mitigating the issue by restricting network access to the iperf3 control port via firewall rules and enforcing memory limits on the iperf3 process or container. Authentication is insufficient as the memory allocation occurs before authentication checks. No official patch or fix has been confirmed at this time.

The vulnerability allows remote unauthenticated attackers to cause excessive memory consumption in the iperf3 service, leading to denial of service conditions such as memory exhaustion, severe slowdown, or termination of the service. There is no impact on confidentiality or integrity. The availability impact is low but can disrupt service availability.

No official fix or patch is currently confirmed. To mitigate this vulnerability, restrict network access to the iperf3 control port so that only trusted clients can connect, using firewall rules. Additionally, run the iperf3 service in environments that enforce process or container memory limits to contain potential resource exhaustion. Note that authentication alone is insufficient to prevent exploitation as the memory allocation occurs before authentication.