Loading story…
Wireshark disclosed CVE-2026-0960, an infinite-loop flaw in its HTTP/3 dissector that can be triggered when the application decrypts traffic in a crafted packet-capture file. Opening such a PCAPNG capture can cause Wireshark to hang and consume excessive CPU resources, creating a denial-of-service risk for analysts.
The issue affects Wireshark versions 4.6.0 through 4.6.2 and 4.4.0 through 4.4.12. Wireshark fixed the vulnerability in versions 4.6.3 and 4.4.13; the vendor reported no known exploitation when it published the advisory.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Wireshark published advisory wnpa-sec-2026-04 for CVE-2026-0960, an HTTP/3 dissector infinite loop that can cause excessive CPU use when a user opens a malformed trace file. The issue affects versions 4.6.0–4.6.2 and 4.4.0–4.4.12 and was fixed in versions 4.6.3 and 4.4.13; Wireshark said it knew of no exploitation.
Tom Needham reported Wireshark issue 20944, describing a hang when Wireshark loads and decrypts a PCAPNG capture file.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed **wnpa-sec-2026-61** for multiple infinite-loop vulnerabilities in its protocol dissectors, warning that malformed traffic or crafted capture files could drive excessive CPU consumption during analysis. The affected components include the **MIH**, **MPEG DSM-CC**, **eDonkey**, and **MEGACO** dissectors, and the vendor said the flaws affect Wireshark **4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**. Fixed releases are **4.6.7** and **4.4.17**, and Wireshark said it was not aware of exploitation at disclosure time. The bugs were uncovered by Wireshark's internal fuzzing pipeline, which repeatedly crashed `tshark` on malformed `.pcap` inputs. GitLab issue reports show one flaw in the **MPEG DSM-CC** dissector where parsing failed to advance offsets in a loop, and another in the **eDonkey** dissector where list parsing allowed offsets to move backward, both leading to aborts consistent with infinite-loop conditions; one issue was tracked as **`CVE-2026-15163`**. Wireshark's advisory says an attacker could trigger the condition either by injecting malformed packets onto a network or by convincing a user to open a malicious capture file.
Aug 21, 2026
Wireshark disclosed **CVE-2026-6536**, an infinite-loop vulnerability in its DLMS/COSEM dissector that can cause Wireshark or TShark to consume nearly 100% CPU indefinitely. An attacker can trigger the denial of service by sending a crafted COSEM/DLMS UDP packet to the default port `4059` or by supplying a malicious capture file for analysis. The flaw occurs when the dissector parses a compact array with a zero-element structure as its type description: the content offset fails to advance while the enclosing parsing loop continues. The issue affects Wireshark versions **4.6.0 through 4.6.4**, was also reproduced in a 4.7.0 development build, and was resolved through merge request `!23866`; Wireshark identifies version **4.6.4** as the fixed release in advisory `wnpa-sec-2026-25`.
Sep 23, 2026
Wireshark disclosed **CVE-2026-6528**, a denial-of-service vulnerability in its TLS protocol dissector. Crafted TLS traffic can cause the dissector to enter an infinite loop, potentially hanging analysis sessions or consuming resources while affected packet captures or live traffic are processed. The issue affects Wireshark versions **4.6.0 through 4.6.4** and is fixed in **4.6.5**. The advisory, **WNPA-SEC-2026-33**, links the flaw to TLS Encrypted ClientHello (ECH) transcript handling and references upstream issues `#21151` and `#21147`; organizations using affected versions should upgrade to 4.6.5 and avoid processing untrusted TLS captures until patched.
Sep 23, 2026