CVE-2025-54349 is a medium severity (CVSS 6.5) off by one error in iperf3's iperf_auth.c that causes a heap based buffer overflow. Versions before 3.19.1 are affected. Upgrade to iperf 3.19.1 or later, or install your distribution's patched package. The sections below cover who is affected, how to check, and what to do first.
What's affected
- iperf3 before 3.19.1 is affected, per the record.
- iperf 3.19.1 is the fixed release, and the project has a release page for it.
- Debian published an LTS announcement for the issue, so Debian based systems may have a patched package under an older version number.
The record lists CVSS 6.5 (Medium). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Check the installed version.
iperf3 --version
On Debian or Ubuntu, a distribution package may carry a backported fix while still showing an older version string. Check the package changelog or your vendor's security tracker.
apt changelog iperf3 | head -40
What to do now
- Upgrade iperf3 to 3.19.1 or later, or apply your distribution's security update.
- Do not expose iperf3 servers to the internet. Limit them to test networks.
- Rebuild any container images or appliances that bundle iperf3.
- Scan your images and hosts for the package to find forgotten copies.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
An off by one error is a counting mistake at the edge of a buffer. Here the record ties it to the authentication code, where the program handles credentials, and the result is a heap overflow. The weakness is CWE-193.
iperf3 is a test tool, so it often lives on engineer laptops, lab hosts and base images where nobody tracks it. A dependency scan finds those copies. Run the free in browser scan on a manifest or image list to see where it hides.
Severity scores are a starting point. The score for this entry is 6.5, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Does it affect iperf3 clients or servers?
The record does not say. Treat both as in scope and upgrade.
Is my distribution safe if the version looks old?
Possibly. Distributions backport fixes, so read the package changelog.
Sources
- https://github.com/esnet/iperf/commit/4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf
- https://github.com/esnet/iperf/releases/tag/3.19.1
- https://lists.debian.org/debian-lts-announce/2025/08/msg00020.html
Last reviewed: 18 October 2026.
