Medium severity · published Mar 18, 2024
CVE-2023-7250
A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
8.0; 9.0 · source: NVD
EL
Enterprise Linux For Arm 64 · Redhat
8.0_aarch64; 9.0_aarch64 · source: NVD
EL
Enterprise Linux For Ibm Z Systems · Redhat
8.0_s390x; 9.0_s390x · source: NVD
EL
Enterprise Linux For Power Little Endian · Redhat
8.0_ppc64le · source: NVD
IP
Iperf3 · ES
before 3.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-7250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-7250
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4241
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:9185
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-7250
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2244707
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/01/msg00027.html
More from Iperf3
10.0
CVE-2025-54351
In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv)
10.0
CVE-2025-54349
In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow
9.8
CVE-2016-4303
The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code…
7.5
CVE-2024-53580
iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function
7.5
CVE-2023-38403
iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field