{"id":"CVE-2026-101283","published":"2026-09-30T22:16:33.317","lastModified":"2026-10-01T16:17:32.460","description":"iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-122"],"vendors":[],"products":[],"references":[{"url":"https://newreleases.io/project/github/esnet/iperf/release/3.22","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}