Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-101283: iperf3 3.20-3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken;
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | iperf3 | 0:3.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | iperf3-debuginfo | 0:3.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | iperf3-debugsource | 0:3.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | iperf3-devel | 0:3.22-1.amzn2023.0.1 |
Vulnerabilities 1
-
Critical 9.2
iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is B…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-101283.html