CVE-2024-26306

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-14 · updated 2026-06-17
Weakness: CWE-385

Description

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

Affected products

ES iperf3: before 3.17 — fixed in 3.17
NetApp Bootstrap Os: all versions

How to fix

Upgrade to a fixed version: ES iperf3 3.17. Check the vendor advisory for mitigations.

References

https://downloads.es.net/pub/iperf/esnet-secadv-2024-0001.txt.asc
https://github.com/esnet/iperf/releases/tag/3.17
https://www.insyde.com/security-pledge/SA-2024005
https://downloads.es.net/pub/iperf/esnet-secadv-2024-0001.txt.asc
https://github.com/esnet/iperf/releases/tag/3.17
https://lists.debian.org/debian-lts-announce/2025/01/msg00027.html
https://security.netapp.com/advisory/ntap-20250228-0007/

Get alerted when CVE-2024-26306 or the next vulnerability affects your stack