Wireshark: 21 DoS Vulnerabilities in Dissectors and Parsers Disclosed Together
Key findings • 21 denial-of-service vulnerabilities disclosed in Wireshark on August 19, 2026. • Flaws affect multiple protocol dissectors including X.509IF, C12.22, RRC, and Kerberos. • …
Key findings
- 21 denial-of-service vulnerabilities disclosed in Wireshark on August 19, 2026.
- Flaws affect multiple protocol dissectors including X.509IF, C12.22, RRC, and Kerberos.
- Several file parsers, such as Pcapng and BUSMASTER, are also impacted.
- Vulnerabilities impact Wireshark versions 4.6.0-4.6.7 and 4.4.0-4.4.18.
- Users are urged to update to patched versions to mitigate risks.
On August 19, 2026, a significant batch of 21 vulnerabilities was disclosed for the Wireshark network protocol analyzer. These vulnerabilities, all disclosed on the same day, primarily involve denial-of-service (DoS) flaws stemming from crashes in various protocol dissectors and file parsers within the affected versions. The widespread nature of these issues across multiple components highlights potential risks for users relying on Wireshark for network analysis.
The disclosed vulnerabilities affect Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. The majority of these flaws are categorized as medium severity, with several critical and high-severity issues also present.
A notable cluster of vulnerabilities targets specific protocol dissectors. These include crashes in the X.509IF dissector (CVE-2026-76928), C12.22 dissector (CVE-2026-76886, CVE-2026-76879), RRC dissector (CVE-2026-76880), and Kerberos dissector (CVE-2026-76924). Other affected protocols include H.245 (CVE-2026-76927), ESS (CVE-2026-76919), SSH (CVE-2026-76918), UMTS FP (CVE-2026-76889), RDP (CVE-2026-76888), and Bluetooth-related protocols such as HFP (CVE-2026-76923), BR/EDR FHS (CVE-2026-76922), and Attribute Protocol (CVE-2026-76882).
File parser vulnerabilities were also disclosed, impacting the Pcapng file parser (CVE-2026-76929), BUSMASTER file parser (CVE-2026-76926), 3gpp phone log file parser (CVE-2026-76920), and ERF file parser (CVE-2026-76884). Additionally, a general crash in the Wireshark dissection engine was reported (CVE-2026-76887).
The primary impact of these vulnerabilities is denial of service, meaning that a specially crafted network packet or file could cause Wireshark to crash, disrupting analysis. While no specific threat actors or in-the-wild exploitation were mentioned in the disclosure, the sheer number of vulnerabilities suggests a broad attack surface.
Wireshark has addressed these issues in subsequent releases. Users are strongly advised to update to patched versions to mitigate these risks. Specific version information for fixes is not detailed in the provided CVE data, but users should consult the official Wireshark security advisories for the most up-to-date information.
This batch of vulnerabilities underscores the importance of keeping network analysis tools updated. Users of Wireshark should prioritize applying patches to ensure the stability and security of their analysis environments. Continued vigilance and prompt updates are crucial for maintaining the integrity of network traffic inspection.