Esnet vulnerabilities
We track 3 vulnerabilities in Esnet products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
Latest Esnet vulnerabilities
- 9.2 Critical severity
iperf3: Heap-based Buffer Overflow
iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized a
- 9.2 Critical severity
iperf3: Use After Free
iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in
- 7.5 High severity
iperf3: Loop with Unreachable Exit Condition
iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter messag