Skip to content
OpenAdvisories
Medium ALAS2023-2026-3299 1 CVE

Moderate: iperf3 security update (Amazon Linux 2023)

Published Oct 26, 2026 · Updated Oct 26, 2026

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-101283: iperf3 3.20-3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken;

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2023 iperf3 0:3.22-1.amzn2023.0.1
Amazon Linux · 2023 iperf3-debuginfo 0:3.22-1.amzn2023.0.1
Amazon Linux · 2023 iperf3-debugsource 0:3.22-1.amzn2023.0.1
Amazon Linux · 2023 iperf3-devel 0:3.22-1.amzn2023.0.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-101283.html