critical
CVE-2025-54349
iperf3: iperf Heap Buffer Overflow
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Julia10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Julia, Photon OS. Rated lower by Red Hat (medium), AlmaLinux (medium), Amazon (medium), Azure Linux (medium), CBL-Mariner (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (medium).
Description
In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | iperf_jll | 3.21.0+0 |
| Photon OS 4.0 | iperf, iperf-doc | 3.19.1-1.ph4 |
| Photon OS 5.0 | iperf, iperf-doc | 3.17.1-4.ph5 |
| alma 8 | iperf3 | 3.5-12.el8_10 |
| alma 9 | iperf3 | 3.9-14.el9_7.1 |
| alpine 3.22 | iperf3 | 3.19.1-r0 |
| alpine 3.23 | iperf3 | 3.19.1-r0 |
| alpine 3.24 | iperf3 | 3.19.1-r0 |
| alpine edge | iperf3 | 3.19.1-r0 |
| amazon linux 2023 | iperf3, iperf3-debuginfo, iperf3-debugsource and 1 more | 3.19.1-1.amzn2023 |
| Azure Linux 3.0 | iperf3 | 0:3.17.1-3.azl3 |
| CBL-Mariner 2.0 | iperf3 | 0:3.18-2.cm2 |
Show all 44 entries from 38 sources
| Source | Package | Fixed in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | iperf_jll | 3.21.0+0 |
| Photon OS 4.0 | iperf | 3.19.1-1.ph4 |
| Photon OS 4.0 | iperf-doc | 3.19.1-1.ph4 |
| Photon OS 5.0 | iperf | 3.17.1-4.ph5 |
| Photon OS 5.0 | iperf-doc | 3.17.1-4.ph5 |
| alma 8 | iperf3 | 3.5-12.el8_10 |
| alma 9 | iperf3 | 3.9-14.el9_7.1 |
| alpine 3.22 | iperf3 | 3.19.1-r0 |
| alpine 3.23 | iperf3 | 3.19.1-r0 |
| alpine 3.24 | iperf3 | 3.19.1-r0 |
| alpine edge | iperf3 | 3.19.1-r0 |
| amazon linux 2023 | iperf3 | 3.19.1-1.amzn2023 |
| amazon linux 2023 | iperf3-debuginfo | 3.19.1-1.amzn2023 |
| amazon linux 2023 | iperf3-debugsource | 3.19.1-1.amzn2023 |
| amazon linux 2023 | iperf3-devel | 3.19.1-1.amzn2023 |
| Azure Linux 3.0 | iperf3 | 0:3.17.1-3.azl3 |
| CBL-Mariner 2.0 | iperf3 | 0:3.18-2.cm2 |
| debian 11 | iperf3 | 3.9-1+deb11u3 |
| debian 12 | iperf3 | 3.12-1+deb12u2 |
| debian 13 | iperf3 | 3.18-2+deb13u1 |
| debian 14 | iperf3 | 3.19.1-1 |
| echo | iperf3 | 3.12-1+deb12u2 |
| Oracle Linux 8 | iperf3 | 3.5-12.el8_10 |
| Oracle Linux 9 | iperf3 | 3.9-14.el9_7.1 |
| rapidfort alpine 3.20 | iperf3 | 3.19.1-r0 |
| rapidfort alpine 3.21 | iperf3 | 3.19.1-r0 |
| rapidfort alpine 3.23 | iperf3 | 3.19.1-r0 |
| rapidfort alpine 3.24 | iperf3 | 3.19.1-r0 |
| rapidfort amazon linux 2023 | iperf3 | 3.19.1-1.amzn2023 |
| rapidfort amazon linux 2023 | iperf3-devel | 3.19.1-1.amzn2023 |
| rapidfort debian 12 | iperf3 | 0:3.12-1+deb12u2, 0:3.18-2+deb13u1, 0:3.19.1-1 |
| rapidfort debian 13 | iperf3 | 0:3.12-1+deb12u2, 0:3.18-2+deb13u1, 0:3.19.1-1 |
| rapidfort Oracle Linux 10 | iperf3 | 0:3.17.1-5.el10_1 |
| rapidfort Oracle Linux 9 | iperf3 | 0:3.9-14.el9_7.1 |
| rapidfort ubuntu 20.04 | iperf3 | 0:3.18-2ubuntu0.1, 0:3.9-1+deb11u1ubuntu0.1 |
| rapidfort ubuntu 22.04 | iperf3 | 0:3.18-2ubuntu0.1, 0:3.9-1+deb11u1ubuntu0.1 |
| rapidfort ubuntu 24.04 | iperf3 | 0:3.18-2ubuntu0.1, 0:3.9-1+deb11u1ubuntu0.1 |
| rocky 10 | iperf3 | 3.17.1-5.el10_1 |
| rocky 8 | iperf3 | 3.5-12.el8_10 |
| rocky 9 | iperf3 | 3.9-14.el9_7.1 |
| ubuntu 20.04-ESM | iperf3 | 3.7-3ubuntu0.1~esm2 |
| ubuntu 22.04 | iperf3 | 3.9-1+deb11u1ubuntu0.1 |
| ubuntu 24.04 | iperf3 | no fix listed |
| ubuntu 25.10 | iperf3 | 3.18-2ubuntu0.1 |
References
- https://access.redhat.com/errata/RHSA-2026:1595
- https://access.redhat.com/security/cve/CVE-2025-54349
- https://bugzilla.redhat.com/2386151
- https://bugzilla.redhat.com/show_bug.cgi?id=2386151
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54349
- https://errata.almalinux.org/9/ALSA-2026-1595.html
- https://errata.rockylinux.org/RLSA-2026:1595
All 16 references
- https://github.com/esnet/iperf/commit/4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf
- https://github.com/esnet/iperf/releases/tag/3.19.1
- https://linux.oracle.com/cve/CVE-2025-54349.html
- https://linux.oracle.com/errata/ELSA-2026-1597.html
- https://lists.debian.org/debian-lts-announce/2025/08/msg00020.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-54349
- https://ubuntu.com/security/notices/USN-7970-1
- https://www.cve.org/CVERecord?id=CVE-2025-54349