One UDP Packet to Freeze an iperf3 Server: CVE-2026-102253
A single crafted parameter message and one 16-byte UDP datagram pin an iperf3 server’s receive thread at 100% CPU forever — unauthenticated, no valid test session. Fixed in iperf3 3.22.
A single crafted parameter message and one 16-byte UDP datagram pin an iperf3 server’s receive thread at 100% CPU forever — unauthenticated, no valid test session. Fixed in iperf3 3.22.