Backport upstream fix (commit 494dd377) for CVE-2026-71217
to iperf3 3.5. The patch adds bounds checking for all
peer-controlled JSON parameters in get_parameters() and
additional bounds checks in iperf_parse_arguments(), preventing
malicious clients/servers from injecting out-of-range values
for parameters such as num_streams, window size, MSS, TOS,
bandwidth, burst, and others.
CVE: CVE-2026-71217
Upstream patches:
- 494dd377ec.patch
Resolves: RHEL-236174
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
