Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-3869
Advisory Released Date: 2026-08-31
Advisory Updated Date: 2026-08-31
Severity:
Important
Issue Overview:
A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server. (CVE-2026-71217)
Affected Packages:
iperf3
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update iperf3 or yum update --advisory ALAS2-2026-3869 to update your system.
New Packages:
aarch64:
iperf3-3.1.7-2.amzn2.0.6.aarch64
iperf3-devel-3.1.7-2.amzn2.0.6.aarch64
iperf3-debuginfo-3.1.7-2.amzn2.0.6.aarch64
i686:
iperf3-3.1.7-2.amzn2.0.6.i686
iperf3-devel-3.1.7-2.amzn2.0.6.i686
iperf3-debuginfo-3.1.7-2.amzn2.0.6.i686
src:
iperf3-3.1.7-2.amzn2.0.6.src
x86_64:
iperf3-3.1.7-2.amzn2.0.6.x86_64
iperf3-devel-3.1.7-2.amzn2.0.6.x86_64
iperf3-debuginfo-3.1.7-2.amzn2.0.6.x86_64