A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2070 advisory.

    A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-     channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly     validated by the server. This improper input validation can lead to excessive stream and thread creation,     as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a     Denial of Service (DoS) on the affected iperf3 server. (CVE-2026-71217)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of iperf3 installed on the remote host is prior to 3.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3869 advisory.

    A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-     channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly     validated by the server. This improper input validation can lead to excessive stream and thread creation,     as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a     Denial of Service (DoS) on the affected iperf3 server. (CVE-2026-71217)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:61257 advisory.

    * iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of     service via resource exhaustion (CVE-2026-71217)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:61389 advisory.

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP     characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

    Security Fix(es):

    * iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of     service via resource exhaustion (CVE-2026-71217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:61680 advisory.

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP     characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

    Security Fix(es):

    * iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of     service via resource exhaustion (CVE-2026-71217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:61257 advisory.

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP     characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

    Security Fix(es):

    * iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of     service via resource exhaustion (CVE-2026-71217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:61257 advisory.

    * iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of     service via resource exhaustion (CVE-2026-71217)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104808 advisory.

    A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-     channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly     validated by the server. This improper input validation can lead to excessive stream and thread creation,     as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a     Denial of Service (DoS) on the affected iperf3 server.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-     channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly     validated by the server. This improper input validation can lead to excessive stream and thread creation,     as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a     Denial of Service (DoS) on the affected iperf3 server. (CVE-2026-71217)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341889	Amazon Linux 2023 : iperf3, iperf3-devel (ALAS2023-2026-2070)	Nessus	Amazon Linux Local Security Checks	Local	high
341846	Amazon Linux 2 : iperf3, --advisory ALAS2-2026-3869 (ALAS-2026-3869)	Nessus	Amazon Linux Local Security Checks	Local	high
341741	AlmaLinux 8 : iperf3 (ALSA-2026:61257)	Nessus	Alma Linux Local Security Checks	Local	high
341732	RHEL 9 : iperf3 (RHSA-2026:61389)	Nessus	Red Hat Local Security Checks	Local	high
341723	RHEL 10 : iperf3 (RHSA-2026:61680)	Nessus	Red Hat Local Security Checks	Local	high
341701	RHEL 8 : iperf3 (RHSA-2026:61257)	Nessus	Red Hat Local Security Checks	Local	high
341688	RockyLinux 8 : iperf3 (RLSA-2026:61257)	Nessus	Rocky Linux Local Security Checks	Local	high
340953	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: iperf3 (UTSA-2026-104808)	Nessus	Unity Linux Local Security Checks	Local	high
334504	Linux Distros Unpatched Vulnerability : CVE-2026-71217	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-71217

high

Tenable Plugins

high

high

high

high

high

high

high

high

high