Loading story…
Wireshark disclosed CVE-2026-6536, an infinite-loop vulnerability in its DLMS/COSEM dissector that can cause Wireshark or TShark to consume nearly 100% CPU indefinitely. An attacker can trigger the denial of service by sending a crafted COSEM/DLMS UDP packet to the default port 4059 or by supplying a malicious capture file for analysis.
The flaw occurs when the dissector parses a compact array with a zero-element structure as its type description: the content offset fails to advance while the enclosing parsing loop continues. The issue affects Wireshark versions 4.6.0 through 4.6.4, was also reproduced in a 4.7.0 development build, and was resolved through merge request !23866; Wireshark identifies version 4.6.4 as the fixed release in advisory wnpa-sec-2026-25.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Wireshark published advisory wnpa-sec-2026-25 for an infinite-loop denial-of-service flaw in the DLMS/COSEM dissector affecting versions 4.6.0 through 4.6.4. The advisory identifies Wireshark 4.6.4 as the fixed release and references issue 21065.
A crafted COSEM/DLMS packet or capture file containing a compact array with a zero-element structure could cause Wireshark or TShark to loop indefinitely at approximately 100% CPU. The issue, assigned CVE-2026-6536, was closed after merge request !23866, “DLMS/COSEM: Make sure the offset advances,” was merged.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed **CVE-2026-0960**, an infinite-loop flaw in its HTTP/3 dissector that can be triggered when the application decrypts traffic in a crafted packet-capture file. Opening such a PCAPNG capture can cause Wireshark to hang and consume excessive CPU resources, creating a denial-of-service risk for analysts. The issue affects Wireshark versions `4.6.0` through `4.6.2` and `4.4.0` through `4.4.12`. Wireshark fixed the vulnerability in versions `4.6.3` and `4.4.13`; the vendor reported no known exploitation when it published the advisory.
Sep 23, 2026
Wireshark disclosed **CVE-2026-6531**, an uncontrolled resource consumption flaw in the SANE protocol dissector that can cause **Wireshark** or **tshark** to hang indefinitely at **100% CPU** while parsing a crafted packet. The bug is in `dissect_control_option_value()` in `packet-sane.c`, where an attacker-controlled `array_length` can drive an effectively empty loop for up to roughly `2^31` iterations when an invalid or unrecognized `value_type` is processed. The issue is reachable through SANE `SANE_NET_CONTROL_OPTION` request and response parsing on TCP port `6566`, and a single crafted **119-byte Ethernet frame** was reported as sufficient to trigger the condition. Wireshark said the vulnerability affects versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**, and that fixes were released in **4.6.5** and **4.4.15**. Upstream issue tracking also noted the flaw in the 4.7.0 development line before the report was closed and linked to merged fixes. The vendor classified the bug as a denial-of-service condition caused by an infinite loop in SANE packet dissection and tied its advisory to public bug report **#21139**.
Aug 21, 2026
Wireshark disclosed **CVE-2026-6528**, a denial-of-service vulnerability in its TLS protocol dissector. Crafted TLS traffic can cause the dissector to enter an infinite loop, potentially hanging analysis sessions or consuming resources while affected packet captures or live traffic are processed. The issue affects Wireshark versions **4.6.0 through 4.6.4** and is fixed in **4.6.5**. The advisory, **WNPA-SEC-2026-33**, links the flaw to TLS Encrypted ClientHello (ECH) transcript handling and references upstream issues `#21151` and `#21147`; organizations using affected versions should upgrade to 4.6.5 and avoid processing untrusted TLS captures until patched.
Sep 23, 2026