# CVE-2026-71218: Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion

Status: published. Published: 2026-08-11. Updated: 2026-11-05.

A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.

## Remediation

- workaround: To mitigate this issue, restrict network access to the `iperf3` control port, ensuring it is only reachable by trusted clients. This can be achieved by configuring firewall rules to limit inbound connections to the `iperf3` service. Additionally, consider running the `iperf3` service within environments that enforce process or container memory limits to further contain potential resource exhaustion. Note that authentication alone is insufficient as the memory allocation occurs before authentication checks. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 10 (iperf3): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (iperf3): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (iperf3): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (iperf3): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 5.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.38% as of 2026-11-05; percentile 32.59%

- SSVC: exploitation none; automatable yes; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-789

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/security/cve/CVE-2026-71218 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2463003 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://github.com/esnet/iperf/commit/0128d0357b7e8916fe39e980e455729bc0e5fd4e (CNA: redhat)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-71218; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-71218; retrieved 2026-11-05; source updated Not reported

Revision: 51015d50416317ec281910d51b07fe68b7c2a5ae25a3a7c29b39f466cbcadf09

Canonical: https://y2.dev/cve/CVE-2026-71218

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.