Es Iperf3
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Es Iperf3.
By the Year
In 2026 there have been 0 vulnerabilities in Es Iperf3. Last year, in 2025 Iperf3 had 2 security vulnerabilities published. Right now, Iperf3 is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 2 | 5.10 |
| 2024 | 1 | 5.30 |
It may take a day or so for new Iperf3 vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Es Iperf3 Security Vulnerabilities
iperf <3.19.1 Heap BOF via off-by-one in iperf_auth.c
CVE-2025-54349
6.5 - Medium
- August 03, 2025
In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow.
off-by-five
Assertion Failure Crash in iperf <3.19.1 on Malformed Auth
CVE-2025-54350
3.7 - Low
- August 03, 2025
In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt.
assertion failure
iperf DoS via Insufficient Data from Malicious Client (CVE-2023-7250)
CVE-2023-7250
5.3 - Medium
- March 18, 2024
A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.
Allowlist / Allow List
The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which
CVE-2016-4303
- September 26, 2016
The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.
