Loading story…
Wireshark disclosed wnpa-sec-2026-42 for an infinite loop vulnerability in its RPKI-Router protocol dissector, tracked as CVE-2026-6522. The flaw can be triggered by a malformed packet seen on the wire or by opening a malformed packet trace file, causing Wireshark to enter an infinite loop and consume excessive CPU resources, resulting in a crash or denial-of-service condition.
The issue affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. Wireshark said it is not aware of exploitation in the wild and credited Sharon Brizinov with discovering the bug. Users are advised to upgrade to 4.6.5, 4.4.15, or later to remediate the vulnerability.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-6522 was published, documenting a denial-of-service infinite loop in Wireshark's RPKI-Router protocol dissector. The record references Wireshark advisory WNPA-SEC-2026-42, affected versions 4.6.0-4.6.4 and 4.4.0-4.4.14, fixed versions 4.6.5 and 4.4.15, and credits Sharon Brizinov as the finder.
Wireshark stated the vulnerability was fixed in versions 4.6.5 and 4.4.15 or later. The advisory also noted that Sharon Brizinov discovered the issue and that Wireshark was unaware of exploitation in the wild.
Wireshark published security advisory wnpa-sec-2026-42 for CVE-2026-6522, an infinite loop vulnerability in the RPKI-Router protocol dissector. The flaw affects versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, and Wireshark said malformed packets or trace files could cause excessive CPU consumption.
A GitLab issue was opened to track an infinite loop vulnerability in Wireshark's RPKI-RTR dissector, associated with crash/DoS behavior. The issue is referenced later by Wireshark advisory wnpa-sec-2026-42.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcewireshark.org
Open sourcegitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed **CVE-2026-6521**, a flaw in its OpenFlow v5 protocol dissector that can enter infinite loops and drive excessive CPU consumption. The issue affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**, and can be triggered either by injecting a malformed packet onto the network or by opening a specially crafted packet capture file. The vendor said it is **not aware of active exploitation** and credited Sharon Brizinov with discovering the bug. Wireshark released fixes in versions **4.6.5** and **4.4.15**, and linked the issue to internal trackers **21182** and **21188**. The vulnerability is cataloged as **CVE-2026-6521** in the CVE record.
Aug 21, 2026
Wireshark disclosed **wnpa-sec-2026-61** for multiple infinite-loop vulnerabilities in its protocol dissectors, warning that malformed traffic or crafted capture files could drive excessive CPU consumption during analysis. The affected components include the **MIH**, **MPEG DSM-CC**, **eDonkey**, and **MEGACO** dissectors, and the vendor said the flaws affect Wireshark **4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**. Fixed releases are **4.6.7** and **4.4.17**, and Wireshark said it was not aware of exploitation at disclosure time. The bugs were uncovered by Wireshark's internal fuzzing pipeline, which repeatedly crashed `tshark` on malformed `.pcap` inputs. GitLab issue reports show one flaw in the **MPEG DSM-CC** dissector where parsing failed to advance offsets in a loop, and another in the **eDonkey** dissector where list parsing allowed offsets to move backward, both leading to aborts consistent with infinite-loop conditions; one issue was tracked as **`CVE-2026-15163`**. Wireshark's advisory says an attacker could trigger the condition either by injecting malformed packets onto a network or by convincing a user to open a malicious capture file.
Aug 21, 2026
Wireshark disclosed **CVE-2026-5407**, an infinite-loop denial-of-service flaw in its SMB2 protocol dissector that can cause the application to consume excessive CPU resources when processing a malformed network packet or a crafted packet capture file. The issue was documented in a GitLab report and later published by Wireshark as advisory `wnpa-sec-2026-11`. The vulnerability affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**. Wireshark said the flaw was fixed in versions **4.6.5** and **4.4.15**, and reported that no exploits were known at the time of disclosure. Organizations that use Wireshark for packet analysis should update affected installations to the patched releases to prevent malformed SMB2 traffic or capture files from locking the tool into an infinite loop.
Aug 21, 2026