CVE-2023-7250 Iperf3: possible denial of service
A malicious client can cause the iperf server to hang indefinitely by sending incomplete data, resulting in a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-7250?
CVE-2023-7250 is a medium-severity denial of service vulnerability in Redhat Enterprise Linux, published on 18 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.
Weakness: CWE-183
Which versions are affected by CVE-2023-7250?
It affects 5 products.
Products include Es Iperf3, Redhat Enterprise Linux, Redhat Enterprise Linux for Arm 64, Redhat Enterprise Linux for Ibm Z Systems, Redhat Enterprise Linux for Power Little Endian.
How do I fix CVE-2023-7250?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-7250 being exploited?
There is no known exploitation of CVE-2023-7250 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as AZL-36892, CLSA-2025-1755006018, DEBIAN-CVE-2023-7250, GHSA-g636-8hgg-7gx9, JLSEC-2026-760, OESA-2024-1418 and 1 more.