Loading story…
Wireshark disclosed CVE-2026-6521, a flaw in its OpenFlow v5 protocol dissector that can enter infinite loops and drive excessive CPU consumption. The issue affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, and can be triggered either by injecting a malformed packet onto the network or by opening a specially crafted packet capture file.
The vendor said it is not aware of active exploitation and credited Sharon Brizinov with discovering the bug. Wireshark released fixes in versions 4.6.5 and 4.4.15, and linked the issue to internal trackers 21182 and 21188. The vulnerability is cataloged as CVE-2026-6521 in the CVE record.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Wireshark stated the CVE-2026-6521 flaw was fixed in versions 4.6.5 and 4.4.15 and recommended users upgrade to those releases or later. The issue was credited to Sharon Brizinov and linked to Wireshark issues 21182 and 21188.
On April 29, 2026, Wireshark published security notice wnpa-sec-2026-39 for CVE-2026-6521, an infinite-loop flaw in the OpenFlow v5 protocol dissector that can lead to excessive CPU consumption when processing malformed packets or packet capture files. Wireshark said affected versions include 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, and that it was unaware of active exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed **wnpa-sec-2026-42** for an infinite loop vulnerability in its RPKI-Router protocol dissector, tracked as **`CVE-2026-6522`**. The flaw can be triggered by a malformed packet seen on the wire or by opening a malformed packet trace file, causing Wireshark to enter an infinite loop and consume excessive CPU resources, resulting in a crash or denial-of-service condition. The issue affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**. Wireshark said it is not aware of exploitation in the wild and credited **Sharon Brizinov** with discovering the bug. Users are advised to upgrade to **4.6.5**, **4.4.15**, or later to remediate the vulnerability.
Aug 21, 2026
Wireshark disclosed **wnpa-sec-2026-61** for multiple infinite-loop vulnerabilities in its protocol dissectors, warning that malformed traffic or crafted capture files could drive excessive CPU consumption during analysis. The affected components include the **MIH**, **MPEG DSM-CC**, **eDonkey**, and **MEGACO** dissectors, and the vendor said the flaws affect Wireshark **4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**. Fixed releases are **4.6.7** and **4.4.17**, and Wireshark said it was not aware of exploitation at disclosure time. The bugs were uncovered by Wireshark's internal fuzzing pipeline, which repeatedly crashed `tshark` on malformed `.pcap` inputs. GitLab issue reports show one flaw in the **MPEG DSM-CC** dissector where parsing failed to advance offsets in a loop, and another in the **eDonkey** dissector where list parsing allowed offsets to move backward, both leading to aborts consistent with infinite-loop conditions; one issue was tracked as **`CVE-2026-15163`**. Wireshark's advisory says an attacker could trigger the condition either by injecting malformed packets onto a network or by convincing a user to open a malicious capture file.
Aug 21, 2026
Wireshark disclosed **CVE-2026-5407**, an infinite-loop denial-of-service flaw in its SMB2 protocol dissector that can cause the application to consume excessive CPU resources when processing a malformed network packet or a crafted packet capture file. The issue was documented in a GitLab report and later published by Wireshark as advisory `wnpa-sec-2026-11`. The vulnerability affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**. Wireshark said the flaw was fixed in versions **4.6.5** and **4.4.15**, and reported that no exploits were known at the time of disclosure. Organizations that use Wireshark for packet analysis should update affected installations to the patched releases to prevent malformed SMB2 traffic or capture files from locking the tool into an infinite loop.
Aug 21, 2026