Tools AI-Found Vulnerability Register aifv-0077
Register entry
iperf3 pre-authentication heap overflow, found by Anthropic's Claude
- CVE
- CVE-2026-101283
- Project
- iperf3 (ESnet)
- Component
- iperf_auth.c, decrypt_rsa_message()
- Finder
- Anthropic (Claude)
- Model
- Claude (version unstated)
- Autonomy
- Anthropic is named as finder and Ada Logics as analyst; the release note thanks Claude and Ada Logics for finding and reporting it
- Evidence tier
- Credits array names the finder
- Assigner
- Anthropic
- Severity
- 9.2 Critical (CVSS 4.0)
- Bounty
- None published
- Confidence
- CONFIRMED
What happened
A pre-authentication heap buffer overflow in iperf3's RSA authentication: a 256-byte buffer is filled with a ciphertext length the client controls, so an oversized authentication token overflows the heap. It affects iperf3 3.20 and 3.21 and is fixed in 3.22. Anthropic published the record as CNA on 30 September 2026, the day after iperf 3.22 shipped, with Anthropic credited as finder.
Credit as recorded: finder: "Anthropic"; analyst: "Ada Logics". iperf 3.22 release notes: "Thanks to Claude and Ada Logics for finding and reporting two potential security vulnerabilities". The iperf 3.22 release notes pair the two identifiers the other way round from the CVE records, listing this flaw as ANT-2026-FXH14FHV / CVE-2026-101276. This row follows the CVE record's own description, the record Anthropic published as CNA. The release note names the model only as Claude. Date basis: datePublished.
Sources
- CVE record, cvelistV5 mirrorraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
- iperf 3.22 release notes (29 September 2026)raw.githubusercontent.com/esnet/iperf/3.22/RELNOTES.md
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 8 October 2026