Loading story…
Wireshark disclosed CVE-2026-6528, a denial-of-service vulnerability in its TLS protocol dissector. Crafted TLS traffic can cause the dissector to enter an infinite loop, potentially hanging analysis sessions or consuming resources while affected packet captures or live traffic are processed.
The issue affects Wireshark versions 4.6.0 through 4.6.4 and is fixed in 4.6.5. The advisory, WNPA-SEC-2026-33, links the flaw to TLS Encrypted ClientHello (ECH) transcript handling and references upstream issues #21151 and #21147; organizations using affected versions should upgrade to 4.6.5 and avoid processing untrusted TLS captures until patched.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Wireshark published advisory WNPA-SEC-2026-33 for CVE-2026-6528, an infinite-loop condition in the TLS protocol dissector that can cause denial of service when processing affected TLS traffic. The issue affects versions 4.6.0 through 4.6.4 and is fixed in Wireshark 4.6.5.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
gitlab.com
Open sourcegitlab.com
Open sourcewireshark.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed **CVE-2026-0960**, an infinite-loop flaw in its HTTP/3 dissector that can be triggered when the application decrypts traffic in a crafted packet-capture file. Opening such a PCAPNG capture can cause Wireshark to hang and consume excessive CPU resources, creating a denial-of-service risk for analysts. The issue affects Wireshark versions `4.6.0` through `4.6.2` and `4.4.0` through `4.4.12`. Wireshark fixed the vulnerability in versions `4.6.3` and `4.4.13`; the vendor reported no known exploitation when it published the advisory.
Sep 23, 2026
Wireshark disclosed **CVE-2026-5407**, an infinite-loop denial-of-service flaw in its SMB2 protocol dissector that can cause the application to consume excessive CPU resources when processing a malformed network packet or a crafted packet capture file. The issue was documented in a GitLab report and later published by Wireshark as advisory `wnpa-sec-2026-11`. The vulnerability affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**. Wireshark said the flaw was fixed in versions **4.6.5** and **4.4.15**, and reported that no exploits were known at the time of disclosure. Organizations that use Wireshark for packet analysis should update affected installations to the patched releases to prevent malformed SMB2 traffic or capture files from locking the tool into an infinite loop.
Aug 21, 2026
Wireshark disclosed **wnpa-sec-2026-42** for an infinite loop vulnerability in its RPKI-Router protocol dissector, tracked as **`CVE-2026-6522`**. The flaw can be triggered by a malformed packet seen on the wire or by opening a malformed packet trace file, causing Wireshark to enter an infinite loop and consume excessive CPU resources, resulting in a crash or denial-of-service condition. The issue affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**. Wireshark said it is not aware of exploitation in the wild and credited **Sharon Brizinov** with discovering the bug. Users are advised to upgrade to **4.6.5**, **4.4.15**, or later to remediate the vulnerability.
Aug 21, 2026