Loading story…
Wireshark disclosed CVE-2026-6531, an uncontrolled resource consumption flaw in the SANE protocol dissector that can cause Wireshark or tshark to hang indefinitely at 100% CPU while parsing a crafted packet. The bug is in dissect_control_option_value() in packet-sane.c, where an attacker-controlled array_length can drive an effectively empty loop for up to roughly 2^31 iterations when an invalid or unrecognized value_type is processed. The issue is reachable through SANE SANE_NET_CONTROL_OPTION request and response parsing on TCP port 6566, and a single crafted 119-byte Ethernet frame was reported as sufficient to trigger the condition.
Wireshark said the vulnerability affects versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, and that fixes were released in 4.6.5 and 4.4.15. Upstream issue tracking also noted the flaw in the 4.7.0 development line before the report was closed and linked to merged fixes. The vendor classified the bug as a denial-of-service condition caused by an infinite loop in SANE packet dissection and tied its advisory to public bug report #21139.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
A CVE record for CVE-2026-6531 was published by MITRE. The provided reference does not include vulnerability details beyond the existence of the CVE entry.
On April 29, 2026, Wireshark published security advisory wnpa-sec-2026-30 describing an infinite loop vulnerability in the SANE protocol dissector, tracked as CVE-2026-6531. The advisory said versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14 were affected, and that fixes were available in 4.6.5 and 4.4.15.
A GitLab issue was created reporting an uncontrolled resource consumption vulnerability in Wireshark's SANE dissector that can cause Wireshark or tshark to hang at 100% CPU when parsing a crafted packet. The report identified the bug in `dissect_control_option_value()` and noted it affected Wireshark 4.7.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcegitlab.com
Open sourcewireshark.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed **CVE-2026-5407**, an infinite-loop denial-of-service flaw in its SMB2 protocol dissector that can cause the application to consume excessive CPU resources when processing a malformed network packet or a crafted packet capture file. The issue was documented in a GitLab report and later published by Wireshark as advisory `wnpa-sec-2026-11`. The vulnerability affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**. Wireshark said the flaw was fixed in versions **4.6.5** and **4.4.15**, and reported that no exploits were known at the time of disclosure. Organizations that use Wireshark for packet analysis should update affected installations to the patched releases to prevent malformed SMB2 traffic or capture files from locking the tool into an infinite loop.
Aug 21, 2026
Wireshark disclosed **wnpa-sec-2026-61** for multiple infinite-loop vulnerabilities in its protocol dissectors, warning that malformed traffic or crafted capture files could drive excessive CPU consumption during analysis. The affected components include the **MIH**, **MPEG DSM-CC**, **eDonkey**, and **MEGACO** dissectors, and the vendor said the flaws affect Wireshark **4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**. Fixed releases are **4.6.7** and **4.4.17**, and Wireshark said it was not aware of exploitation at disclosure time. The bugs were uncovered by Wireshark's internal fuzzing pipeline, which repeatedly crashed `tshark` on malformed `.pcap` inputs. GitLab issue reports show one flaw in the **MPEG DSM-CC** dissector where parsing failed to advance offsets in a loop, and another in the **eDonkey** dissector where list parsing allowed offsets to move backward, both leading to aborts consistent with infinite-loop conditions; one issue was tracked as **`CVE-2026-15163`**. Wireshark's advisory says an attacker could trigger the condition either by injecting malformed packets onto a network or by convincing a user to open a malicious capture file.
Aug 21, 2026
Wireshark disclosed **CVE-2026-3201**, a denial-of-service flaw in its USB HID dissector that can cause excessive memory consumption and make **Wireshark** or **TShark** hang or crash. The bug is tied to `parse_report_descriptor()` in `packet-usb-hid.c`, where crafted HID `USAGE_MINIMUM` and `USAGE_MAXIMUM` values can drive uncontrolled growth through `wmem_array_grow()` when a malformed `pcap` or `pcapng` file is processed. The issue, tracked as Wireshark issue **#20972**, was described as a regression of an earlier fix that had added a descriptor count limit. Wireshark said the vulnerability affects versions **4.6.0 through 4.6.3** and **4.4.0 through 4.4.13**, and can be triggered either by injecting a malformed packet or by convincing a user to open a malicious trace file. The vendor credited **Qi Kery** with discovery, said it was unaware of active exploitation, and released fixes in **4.6.4** and **4.4.14**.
Aug 21, 2026