iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the hea…

{
                    "vendor": "esnet",
                    "product": "iperf3",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "3.20"
                        },
                        {
                            "status": "affected",
                            "version": "3.21"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }