CVE-2026-71217 Denial of service in Red Hat Enterprise Linux 10
Remote attackers can cause denial of service on iperf3 servers by sending oversized JSON parameters that trigger resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71217?
CVE-2026-71217 is a high-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.
Weakness: CWE-20
Which versions are affected by CVE-2026-71217?
Linux distribution packages (15)
iperf3 AlmaLinux:10 | All versions | 3.17.1-6.el10_2.1 |
iperf3 AlmaLinux:8 | All versions | 3.5-12.el8_10.1 |
iperf3 AlmaLinux:9 | All versions | 3.9-17.el9_8.1 |
iperf3 Red Hat:enterprise_linux:10.2 | All versions | 0:3.17.1-6.el10_2.1 |
iperf3-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.17.1-6.el10_2.1 |
iperf3-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:3.17.1-6.el10_2.1 |
iperf3 Red Hat:enterprise_linux:8::appstream | All versions | 0:3.5-12.el8_10.1 |
iperf3-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.5-12.el8_10.1 |
iperf3-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:3.5-12.el8_10.1 |
iperf3 Red Hat:enterprise_linux:9::appstream | All versions | 0:3.9-17.el9_8.1 |
iperf3-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.9-17.el9_8.1 |
iperf3-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:3.9-17.el9_8.1 |
iperf3 Rocky Linux:10 | All versions | 0:3.17.1-6.el10_2.1 |
iperf3 Rocky Linux:8 | All versions | 0:3.5-12.el8_10.1 |
iperf3 Rocky Linux:9 | All versions | 0:3.9-17.el9_8.1 |
How do I fix CVE-2026-71217?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-71217 being exploited?
There is no known exploitation of CVE-2026-71217 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALSA-2026:61257, ALSA-2026:61389, ALSA-2026:61680, AZL-95601, BELL-CVE-2026-71217, CLSA-2026-1788532080 and 11 more.