In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).
    (CVE-2025-54351)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the iperf package has been released.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02749-1 advisory.

    - update to 3.19.1:
      * CVE-2025-54351: Fixed buffer overflow in net.c (bsc#1247522)
      * CVE-2025-54350: Fixed Base64Decode assertion failure and application         exit upon a malformed authentication attempt (bsc#1247520)
      * CVE-2025-54349: Fixed off-by-one error and resultant heap-based         buffer overflow (bsc#1247519)

    - update to 3.19:
      * iperf3 now supports the use of Multi-Path TCP (MPTCPv1) on Linux         with the use of the `-m` or `--mptcp` flag. (PR #1661)
      * iperf3 now supports a `--cntl-ka` option to enable TCP keepalives         on the control connection. (#812, #835, PR #1423)
      * iperf3 now supports the `MSG_TRUNC` receive option, specified by         the `--skip-rx-copy`. This theoretically improves the rated         throughput of tests at high bitrates by not delivering network         payload data to userspace. (#1678, PR #1717)
      * A bug that caused the bitrate setting to be ignored when bursts         are set, has been fixed. (#1773, #1820, PR #1821, PR #1848)
      * The congestion control protocol setting, if used, is now         properly reset between tests. (PR #1812)
      * iperf3 now exits with a non-error 0 exit code if exiting via a         `SIGTERM`, `SIGHUP`, or `SIGINT`. (#1009, PR# 1829)
      * The current behavior of iperf3 with respect to the `-n` and `-k`         options is now documented as correct. (#1768, #1775, #596, PR #1800)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
252890	Linux Distros Unpatched Vulnerability : CVE-2025-54351	Nessus	Misc.	critical
251225	Photon OS 4.0: Iperf PHSA-2025-4.0-0849	Nessus	PhotonOS Local Security Checks	critical
249091	SUSE SLES15 / openSUSE 15 Security Update : iperf (SUSE-SU-2025:02749-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2025-54351

critical

Tenable Plugins

critical

critical

critical