Loading story…
Wireshark disclosed CVE-2024-11595, an infinite-loop flaw in the FiveCo RAP (5CoRAP) protocol dissector. A specially malformed network packet or packet-capture file can cause Wireshark or TShark to consume excessive CPU resources while parsing traffic, creating a denial-of-service condition for analysts opening the capture or processing it automatically.
Wireshark’s ASan Menagerie fuzzing detected the hang in a crafted PCAP after TShark processes exceeded their CPU time limits. The root cause involved handling excessive items without correctly advancing the parsing offset; it was corrected through merge request !17829 and commit d8ca9fc3. The affected releases are Wireshark 4.4.0–4.4.1 and 4.2.0–4.2.8; upgrades to 4.4.2 or 4.2.9 resolve the issue. Wireshark reported no known exploitation.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Wireshark merged merge request !17829 and closed issue #20176 with commit d8ca9fc3, remediating the excessive-CPU condition by advancing the 5CoRAP parsing offset correctly.
Wireshark's automated ASan Menagerie fuzzing detected a CPU-time-limit hang while TShark processed a crafted capture file on the release-4.4 branch. The issue was traced to the 5CoRAP dissector failing to advance its parsing offset correctly when handling too many items.
Wireshark published advisory wnpa-sec-2024-14 for CVE-2024-11595, an infinite-loop flaw affecting the FiveCo RAP dissector in versions 4.4.0–4.4.1 and 4.2.0–4.2.8. The issue was fixed in versions 4.4.2 and 4.2.9; Wireshark said it was found through internal testing and had no known exploitation.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed **CVE-2026-6521**, a flaw in its OpenFlow v5 protocol dissector that can enter infinite loops and drive excessive CPU consumption. The issue affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**, and can be triggered either by injecting a malformed packet onto the network or by opening a specially crafted packet capture file. The vendor said it is **not aware of active exploitation** and credited Sharon Brizinov with discovering the bug. Wireshark released fixes in versions **4.6.5** and **4.4.15**, and linked the issue to internal trackers **21182** and **21188**. The vulnerability is cataloged as **CVE-2026-6521** in the CVE record.
Aug 21, 2026
Wireshark disclosed **wnpa-sec-2026-61** for multiple infinite-loop vulnerabilities in its protocol dissectors, warning that malformed traffic or crafted capture files could drive excessive CPU consumption during analysis. The affected components include the **MIH**, **MPEG DSM-CC**, **eDonkey**, and **MEGACO** dissectors, and the vendor said the flaws affect Wireshark **4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**. Fixed releases are **4.6.7** and **4.4.17**, and Wireshark said it was not aware of exploitation at disclosure time. The bugs were uncovered by Wireshark's internal fuzzing pipeline, which repeatedly crashed `tshark` on malformed `.pcap` inputs. GitLab issue reports show one flaw in the **MPEG DSM-CC** dissector where parsing failed to advance offsets in a loop, and another in the **eDonkey** dissector where list parsing allowed offsets to move backward, both leading to aborts consistent with infinite-loop conditions; one issue was tracked as **`CVE-2026-15163`**. Wireshark's advisory says an attacker could trigger the condition either by injecting malformed packets onto a network or by convincing a user to open a malicious capture file.
Aug 21, 2026
Wireshark disclosed **CVE-2026-0960**, an infinite-loop flaw in its HTTP/3 dissector that can be triggered when the application decrypts traffic in a crafted packet-capture file. Opening such a PCAPNG capture can cause Wireshark to hang and consume excessive CPU resources, creating a denial-of-service risk for analysts. The issue affects Wireshark versions `4.6.0` through `4.6.2` and `4.4.0` through `4.4.12`. Wireshark fixed the vulnerability in versions `4.6.3` and `4.4.13`; the vendor reported no known exploitation when it published the advisory.
Sep 23, 2026