CVE-2026-102253

A flaw was found in iperf3. An unauthenticated remote attacker can exploit this issue by sending a crafted control-channel message followed by a specific User Datagram Protocol (UDP) datagram to the server. This causes the UDP receive processing thread to enter an unrecoverable infinite loop, leading to sustained high CPU utilization and a Denial of Service (DoS) condition.

This vulnerability is rated as Important severity for Red Hat because an unauthenticated remote attacker can trigger complete denial of service through severe CPU resource exhaustion without requiring elevated privileges. While iperf3 is predominantly invoked on demand for diagnostic network throughput benchmarking rather than deployed as a continuous background daemon, any active listener exposed to untrusted network traffic can be forced into an unresponsive state. The affected process ceases responding to control messages and requires manual administrative termination via SIGKILL, rendering benchmarking services unavailable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.