GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
oesa-2026-1547
Vulnerability from osv_openeuler
Published
2026-03-15 11:10
Modified
2026-08-06 11:10
Summary
wireshark security update
Details

Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols.

Security Fix(es):

Wireshark is a widely used network protocol analyzer. In Wireshark versions 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12, there is an out-of-bounds write vulnerability in its IEEE 802.11 protocol dissector. An attacker can exploit this vulnerability by crafting a malicious network packet. During the parsing process, this triggers the vulnerability, causing the Wireshark process to crash, thereby achieving a denial of service attack.(CVE-2026-0959)

Wireshark is a widely used network protocol analyzer. In versions 4.6.0 to 4.6.2, a flaw exists in its HTTP3 protocol dissector. When processing network packets of a specific format, it enters an unreachable exit condition (infinite loop), causing the Wireshark process to hang or crash, resulting in a denial of service.(CVE-2026-0960)

Wireshark is a widely used network protocol analyzer. A vulnerability exists in the BLF file parser of Wireshark versions 4.6.0 to 4.6.2 and versions 4.4.0 to 4.4.12. An attacker can craft a malicious BLF file to trigger an out-of-bounds write in the parser, leading to a crash and resulting in a denial of service.(CVE-2026-0961)

SOME/IP-SD protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service(CVE-2026-0962)

USB HID protocol dissector memory exhaustion in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service(CVE-2026-3201)

RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service(CVE-2026-3203)

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "wireshark-4.4.14-1.oe2203sp4.aarch64.rpm",
          "wireshark-debuginfo-4.4.14-1.oe2203sp4.aarch64.rpm",
          "wireshark-debugsource-4.4.14-1.oe2203sp4.aarch64.rpm",
          "wireshark-devel-4.4.14-1.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "wireshark-help-4.4.14-1.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "wireshark-4.4.14-1.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "wireshark-4.4.14-1.oe2203sp4.x86_64.rpm",
          "wireshark-debuginfo-4.4.14-1.oe2203sp4.x86_64.rpm",
          "wireshark-debugsource-4.4.14-1.oe2203sp4.x86_64.rpm",
          "wireshark-devel-4.4.14-1.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "wireshark",
        "purl": "pkg:rpm/openEuler/wireshark\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.14-1.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "Wireshark allows you to examine protocol data stored in files or as it is\ncaptured from wired or wireless (WiFi or Bluetooth) networks, USB devices,\nand many other sources.  It supports dozens of protocol capture file formats\nand understands more than a thousand protocols.\r\n\r\nSecurity Fix(es):\n\nWireshark is a widely used network protocol analyzer. In Wireshark versions 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12, there is an out-of-bounds write vulnerability in its IEEE 802.11 protocol dissector. An attacker can exploit this vulnerability by crafting a malicious network packet. During the parsing process, this triggers the vulnerability, causing the Wireshark process to crash, thereby achieving a denial of service attack.(CVE-2026-0959)\n\nWireshark is a widely used network protocol analyzer. In versions 4.6.0 to 4.6.2, a flaw exists in its HTTP3 protocol dissector. When processing network packets of a specific format, it enters an unreachable exit condition (infinite loop), causing the Wireshark process to hang or crash, resulting in a denial of service.(CVE-2026-0960)\n\nWireshark is a widely used network protocol analyzer. A vulnerability exists in the BLF file parser of Wireshark versions 4.6.0 to 4.6.2 and versions 4.4.0 to 4.4.12. An attacker can craft a malicious BLF file to trigger an out-of-bounds write in the parser, leading to a crash and resulting in a denial of service.(CVE-2026-0961)\n\nSOME/IP-SD protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service(CVE-2026-0962)\n\nUSB HID protocol dissector memory exhaustion in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service(CVE-2026-3201)\n\nRF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service(CVE-2026-3203)",
  "id": "OESA-2026-1547",
  "modified": "2026-08-06T11:10:33Z",
  "published": "2026-03-15T11:10:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1547"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0959"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0960"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0961"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0962"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3201"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3203"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "wireshark security update",
  "upstream": [
    "CVE-2026-0959",
    "CVE-2026-0960",
    "CVE-2026-0961",
    "CVE-2026-0962",
    "CVE-2026-3201",
    "CVE-2026-3203"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.