What must now be done to get CVE fixed at Red Hat...
The contribution follows mostly the usual "thanks, but no thanks" struggle.
Until you realize ... OMG. Red Hat's trajectory is making things complicated.
I mean, sure this is technically a CVE, but this is an iperf server crash... who ever runs a public iperf instance anyway? All usages I have heard of were either on private network, or manually invoked on public network and immediately shut down after the test. Given that iperf has no authentication of any kind, it's pretty crazy to run publicly for a long interval anyway.
I think one of the issues is that recently Red Hat complained AlmaLinux didn't submit feedback/patches upstream to support the OS. When they did that, along with a patch they were given a song and dance. If you read down the comments there is a great summarization by Jeff Geerling that points to the problems at Red Hat that need to be addressed to better understand the process.