In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1197 advisory.

    In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow.
    (CVE-2025-54349)

    In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a     malformed authentication attempt. (CVE-2025-54350)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4281 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4281-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     August 24, 2025                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : iperf3     Version        : 3.9-1+deb11u3     CVE ID         : CVE-2025-54349 CVE-2025-54350     Debian Bug     : 1110376

    Two vulnerabilities have been fixed in the IP bandwidth measuring tool iperf3.

    CVE-2025-54349

        heap buffer overflow

    CVE-2025-54350

        reachable assert

    For Debian 11 bullseye, these problems have been fixed in version     3.9-1+deb11u3.

    We recommend that you upgrade your iperf3 packages.

    For the detailed security status of iperf3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/iperf3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow.
    (CVE-2025-54349)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the iperf package has been released.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02749-1 advisory.

    - update to 3.19.1:
      * CVE-2025-54351: Fixed buffer overflow in net.c (bsc#1247522)
      * CVE-2025-54350: Fixed Base64Decode assertion failure and application         exit upon a malformed authentication attempt (bsc#1247520)
      * CVE-2025-54349: Fixed off-by-one error and resultant heap-based         buffer overflow (bsc#1247519)

    - update to 3.19:
      * iperf3 now supports the use of Multi-Path TCP (MPTCPv1) on Linux         with the use of the `-m` or `--mptcp` flag. (PR #1661)
      * iperf3 now supports a `--cntl-ka` option to enable TCP keepalives         on the control connection. (#812, #835, PR #1423)
      * iperf3 now supports the `MSG_TRUNC` receive option, specified by         the `--skip-rx-copy`. This theoretically improves the rated         throughput of tests at high bitrates by not delivering network         payload data to userspace. (#1678, PR #1717)
      * A bug that caused the bitrate setting to be ignored when bursts         are set, has been fixed. (#1773, #1820, PR #1821, PR #1848)
      * The congestion control protocol setting, if used, is now         properly reset between tests. (PR #1812)
      * iperf3 now exits with a non-error 0 exit code if exiting via a         `SIGTERM`, `SIGHUP`, or `SIGINT`. (#1009, PR# 1829)
      * The current behavior of iperf3 with respect to the `-n` and `-k`         options is now documented as correct. (#1768, #1775, #596, PR #1800)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
266187	Amazon Linux 2023 : iperf3, iperf3-devel (ALAS2023-2025-1197)	Nessus	Amazon Linux Local Security Checks	critical
254406	Debian dla-4281 : iperf3 - security update	Nessus	Debian Local Security Checks	critical
252889	Linux Distros Unpatched Vulnerability : CVE-2025-54349	Nessus	Misc.	critical
251228	Photon OS 5.0: Iperf PHSA-2025-5.0-0579	Nessus	PhotonOS Local Security Checks	critical
251225	Photon OS 4.0: Iperf PHSA-2025-4.0-0849	Nessus	PhotonOS Local Security Checks	critical
249091	SUSE SLES15 / openSUSE 15 Security Update : iperf (SUSE-SU-2025:02749-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2025-54349

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical