CVE-2026-102253

Katalog CVE

CVSS 7.5 · High EPSS 0,43%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop'). Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

Rincian

Terbit di NVD

29 September 2026

Terakhir diubah

30 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/esnet/iperf/blob/master/RELNOTES.md
• https://github.com/esnet/iperf/releases/tag/3.22
• https://www.vulncheck.com/advisories/iperf3-udp-receive-worker-infinite-loop-dos