Loading story…
Wireshark disclosed CVE-2026-5407, an infinite-loop denial-of-service flaw in its SMB2 protocol dissector that can cause the application to consume excessive CPU resources when processing a malformed network packet or a crafted packet capture file. The issue was documented in a GitLab report and later published by Wireshark as advisory wnpa-sec-2026-11.
The vulnerability affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. Wireshark said the flaw was fixed in versions 4.6.5 and 4.4.15, and reported that no exploits were known at the time of disclosure. Organizations that use Wireshark for packet analysis should update affected installations to the patched releases to prevent malformed SMB2 traffic or capture files from locking the tool into an infinite loop.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Wireshark published advisory wnpa-sec-2026-11 for an SMB2 dissector infinite loop vulnerability, tracked as CVE-2026-5407, affecting versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The company said malformed network packets or packet capture files could trigger excessive CPU consumption and fixed the issue in versions 4.6.5 and 4.4.15, with no known exploits at disclosure.
A GitLab issue was created to track an SMB2 dissector infinite loop denial-of-service bug in Wireshark. This issue is referenced by Wireshark's later security advisory for CVE-2026-5407.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcewireshark.org
Open sourcegitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed **CVE-2026-6533**, a flaw in its dissection engine that can cause the application to crash or consume excessive CPU resources when processing malformed LZ77-compressed data. The issue was reported as an **SMB2 LZ77 decompression bomb** and can be triggered either by a crafted packet seen on the wire or by opening a malicious packet capture file, resulting in a denial-of-service condition for analysts using the tool. The vulnerability affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.9 through 4.4.14**. Wireshark fixed the bug in versions **4.6.5** and **4.4.15**, and credited **Sharon Brizinov** with the discovery. The project said no active exploits were known at the time of disclosure, but organizations that rely on Wireshark for packet analysis should update affected installations to the patched releases.
Aug 21, 2026
Wireshark disclosed **wnpa-sec-2026-42** for an infinite loop vulnerability in its RPKI-Router protocol dissector, tracked as **`CVE-2026-6522`**. The flaw can be triggered by a malformed packet seen on the wire or by opening a malformed packet trace file, causing Wireshark to enter an infinite loop and consume excessive CPU resources, resulting in a crash or denial-of-service condition. The issue affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**. Wireshark said it is not aware of exploitation in the wild and credited **Sharon Brizinov** with discovering the bug. Users are advised to upgrade to **4.6.5**, **4.4.15**, or later to remediate the vulnerability.
Aug 21, 2026
Wireshark disclosed **CVE-2026-6531**, an uncontrolled resource consumption flaw in the SANE protocol dissector that can cause **Wireshark** or **tshark** to hang indefinitely at **100% CPU** while parsing a crafted packet. The bug is in `dissect_control_option_value()` in `packet-sane.c`, where an attacker-controlled `array_length` can drive an effectively empty loop for up to roughly `2^31` iterations when an invalid or unrecognized `value_type` is processed. The issue is reachable through SANE `SANE_NET_CONTROL_OPTION` request and response parsing on TCP port `6566`, and a single crafted **119-byte Ethernet frame** was reported as sufficient to trigger the condition. Wireshark said the vulnerability affects versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**, and that fixes were released in **4.6.5** and **4.4.15**. Upstream issue tracking also noted the flaw in the 4.7.0 development line before the report was closed and linked to merged fixes. The vendor classified the bug as a denial-of-service condition caused by an infinite loop in SANE packet dissection and tied its advisory to public bug report **#21139**.
Aug 21, 2026