CVE-2026-102253: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-102253 is a Denial of Service vulnerability in ESnet's iperf3 network performance tool, classified as a "Loop with Unreachable Exit Condition" (CWE-835). It affects iperf3 versions 3.14 through 3.21 (prior to 3.22) and allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. The vulnerability was reported by Ravindu Lakmina Munaweera (@Ravi-lk) and disclosed on September 29, 2026, with a fix released in iperf3 version 3.22. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Red Hat Advisory, Github Advisory).

The root cause is CWE-835 (Loop with Unreachable Exit Condition), where the iperf3 server's UDP receive worker thread enters an infinite loop with no reachable exit condition upon receiving a specially crafted sequence of messages. An attacker first sends a malformed control-channel parameter message to manipulate server state, then follows it with a single 16-byte UDP datagram that triggers the infinite loop condition in the per-stream receive thread. No authentication, privileges, or user interaction are required — the server must simply be reachable over the network and running in a mode that accepts UDP connections. A proof-of-concept repository was published on GitHub by the reporter (iperf3 Release Notes, Red Hat Bugzilla).

Successful exploitation permanently pins the affected per-stream receive thread at approximately 100% CPU usage, rendering the iperf3 server unusable until forcibly terminated with SIGKILL, as the process does not respond to normal control-channel closure or standard termination signals. The impact is limited to availability — there is no confidentiality or integrity impact — but the denial of service is persistent and unrecoverable without manual intervention. Systems using iperf3 for network performance testing or monitoring in production or lab environments would be rendered non-functional, potentially disrupting network diagnostics and capacity planning operations (Red Hat Bugzilla, Github Advisory).

A proof-of-concept repository (CVE-2026-102253-POC) was published on GitHub by the original reporter, Ravindu Lakmina Munaweera (@Ravi-lk), shortly after disclosure. As of the time of reporting, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.43%, placing it in the 36th percentile for exploitation likelihood within 30 days. The vulnerability is automatable (no user interaction required) and exploitable by any unauthenticated network attacker, making it straightforward to weaponize against exposed iperf3 servers (Github Advisory, Red Hat Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible iperf3 servers running versions 3.14–3.21 using network scanning tools (e.g., Shodan, Nmap targeting default iperf3 port TCP/5201 for control and UDP for data streams).
2. Establish control-channel connection: Connect to the iperf3 server's TCP control channel (default port 5201) to initiate a test session.
3. Send crafted control-channel parameter message: Transmit a specially crafted JSON parameter message over the control channel that manipulates the server's internal state in a way that sets up the infinite loop condition in the UDP receive worker thread.
4. Send trigger UDP datagram: Send a single 16-byte UDP datagram to the server's data port, which triggers the per-stream receive thread to enter an unrecoverable infinite loop.
5. Achieve persistent DoS: The targeted receive thread is now pinned at ~100% CPU usage indefinitely. The server no longer responds to control-channel closure or SIGTERM/SIGINT signals, and must be killed with SIGKILL to recover (Red Hat Bugzilla, iperf3 Release Notes).

• Process: iperf3 server process consuming sustained ~100% CPU on a single core/thread with no active legitimate test; process unresponsive to SIGTERM or SIGINT and requiring SIGKILL to terminate.
• Network: Anomalous inbound connection to iperf3 control port (TCP/5201) followed immediately by a single small (16-byte) UDP datagram with no subsequent legitimate test traffic; connections from unexpected or unknown source IPs.
• Logs: iperf3 server logs showing a test session initiated but never completing or closing normally; absence of normal test-end statistics output after a connection event.
• System: Elevated CPU utilization on the host running iperf3 that persists after all expected test clients have disconnected, detectable via top, htop, or system monitoring tools showing the iperf3 process thread stuck in a tight loop.

Upgrade iperf3 to version 3.22 or later, which contains the fix contributed by the reporter Ravindu Lakmina Munaweera. Microsoft has also issued guidance for affected Azure Linux 3 (AZL3) packages (iperf3 3.17.1-6). As an interim workaround, restrict network access to iperf3 services using firewall rules to allow only trusted hosts to connect to the iperf3 control (TCP/5201) and data (UDP) ports, significantly reducing the attack surface. Monitor systems running iperf3 for abnormal CPU utilization patterns that may indicate an active exploitation attempt (iperf3 Release Notes, Red Hat Bugzilla, Microsoft).

The vulnerability was acknowledged in the official iperf3 3.22 release notes, crediting Ravindu Lakmina Munaweera for both reporting and fixing the issue. Red Hat filed a high-severity bug report and is tracking remediation for affected RHEL packages. The VulnCheck advisory database also published a dedicated advisory for this issue. Community reaction has been relatively muted given the limited scope (iperf3 is primarily a network testing tool rather than a production service), though the ease of exploitation and persistence of the DoS have been noted as notable characteristics.