https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:49:27 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:4241 <p><strong>Affected:</strong> AlmaLinux:8: iperf3</p> <p>Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.</p> <p>Security Fix(es):</p> <p>* iperf3: possible denial of service (CVE-2023-7250) * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: iperf3</p> <p>Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.</p> <p>Security Fix(es):</p> <p>* iperf3: possible denial of service (CVE-2023-7250) * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:4241 https://cve.radiocsirt.org/vuln/bdu:2024-04484 bdu:2024-04484 https://cve.radiocsirt.org/vuln/bdu:2024-04484 https://cve.radiocsirt.org/vuln/bell-cve-2024-26306 <p><strong>Affected:</strong> Alpaquita:23: iperf3, Alpaquita:stream: iperf3</p> <p><strong>Affected:</strong> Alpaquita:23: iperf3, Alpaquita:stream: iperf3</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-26306 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0968 certfr-2024-avi-0968 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0968 https://cve.radiocsirt.org/vuln/euvd-2026-258108 EUVD-2026-258108 https://cve.radiocsirt.org/vuln/euvd-2026-258108 https://cve.radiocsirt.org/vuln/fkie_cve-2024-26306 <p>iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in &#34;Everlasting ROBOT: the Marvin Attack&#34; by Hubert Kario.</p> <p>iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in &#34;Everlasting ROBOT: the Marvin Attack&#34; by Hubert Kario.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-26306 https://cve.radiocsirt.org/vuln/ghsa-x8qh-8j65-v4j9 <p>iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in &#34;Everlasting ROBOT: the Marvin Attack&#34; by Hubert Kario.</p> <p>iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in &#34;Everlasting ROBOT: the Marvin Attack&#34; by Hubert Kario.</p> https://cve.radiocsirt.org/vuln/ghsa-x8qh-8j65-v4j9 https://cve.radiocsirt.org/vuln/gsd-2024-26306 gsd-2024-26306 https://cve.radiocsirt.org/vuln/gsd-2024-26306 https://cve.radiocsirt.org/vuln/icsa-24-319-06 <p>An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query. Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The F…</p> <p>An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query. Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The F…</p> https://cve.radiocsirt.org/vuln/icsa-24-319-06 https://cve.radiocsirt.org/vuln/msrc_cve-2024-26306 msrc_CVE-2024-26306 https://cve.radiocsirt.org/vuln/msrc_cve-2024-26306 https://cve.radiocsirt.org/vuln/oesa-2024-1604 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: iperf3, openEuler:22.03-LTS: iperf3, openEuler:22.03-LTS-SP1: iperf3, openEuler:22.03-LTS-SP3: iperf3</p> <p>Iperf is a tool for active measurements of the maximum achievable bandwidth on IP networks. It supports tuning of various parameters related to timing, protocols, and buffers. Security Fix(es): iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in &amp;quot;Everlasting ROBOT: the Marvin Attack&amp;quot; by Hubert Kario.(CVE-2024-26306)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: iperf3, openEuler:22.03-LTS: iperf3, openEuler:22.03-LTS-SP1: iperf3, openEuler:22.03-LTS-SP3: iperf3</p> <p>Iperf is a tool for active measurements of the maximum achievable bandwidth on IP networks. It supports tuning of various parameters related to timing, protocols, and buffers. Security Fix(es): iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in &amp;quot;Everlasting ROBOT: the Marvin Attack&amp;quot; by Hubert Kario.(CVE-2024-26306)</p> https://cve.radiocsirt.org/vuln/oesa-2024-1604 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13964-1 <p>iperf-3.17.1-1.1 on GA media</p> <p>iperf-3.17.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13964-1 https://cve.radiocsirt.org/vuln/suse-su-2024:1981-1 <p>Security update for iperf</p> <p>Security update for iperf</p> https://cve.radiocsirt.org/vuln/suse-su-2024:1981-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-26306 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: iperf3, Ubuntu:Pro:18.04:LTS: iperf3, Ubuntu:Pro:20.04:LTS: iperf3, Ubuntu:22.04:LTS: iperf3, Ubuntu:Pro:24.04:LTS: iperf3</p> <p>iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in &#34;Everlasting ROBOT: the Marvin Attack&#34; by Hubert Kario.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: iperf3, Ubuntu:Pro:18.04:LTS: iperf3, Ubuntu:Pro:20.04:LTS: iperf3, Ubuntu:22.04:LTS: iperf3, Ubuntu:Pro:24.04:LTS: iperf3</p> <p>iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in &#34;Everlasting ROBOT: the Marvin Attack&#34; by Hubert Kario.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-26306 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1510 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in der Kpomponente iperf3 ausnutzen, um einen Denial of Service Angriff durchzuführen und vertrauliche Informationen offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in der Kpomponente iperf3 ausnutzen, um einen Denial of Service Angriff durchzuführen und vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1510