Summary
The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.
Security Fix(es):
* wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76886)
* wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write (CVE-2026-76880)
* wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector (CVE-2026-76919)
* wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76879)
* wireshark: Wireshark: Denial of Service via X.509IF protocol dissector crash (CVE-2026-76928)
* wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector (CVE-2026-76927)
* wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector (CVE-2026-95387)
* wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-95389)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | wireshark | 1:4.4.2-10.el10_2.8 |
| AlmaLinux · 10 | wireshark-cli | 1:4.4.2-10.el10_2.8 |
| AlmaLinux · 10 | wireshark-devel | 1:4.4.2-10.el10_2.8 |
Vulnerabilities 8
-
High 8.1
Heap-based Buffer Overflow in Wireshark
C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
High 8.1
Heap-based Buffer Overflow in Wireshark
SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
High 8.1
Heap-based Buffer Overflow in Wireshark
SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
High 7.5
Stack-based Buffer Overflow in Wireshark
C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
High 7.5
Out-of-bounds Write in Wireshark
RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
High 7.5
NULL Pointer Dereference in Wireshark
X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.3
Use of Uninitialized Variable in Wireshark
ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 4.7
NULL Pointer Dereference in Wireshark
H.245 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
References
-
report
https://access.redhat.com/security/cve/CVE-2026-76879
-
report
https://access.redhat.com/security/cve/CVE-2026-76880
-
report
https://access.redhat.com/security/cve/CVE-2026-76886
-
report
https://access.redhat.com/security/cve/CVE-2026-76919
-
report
https://access.redhat.com/security/cve/CVE-2026-76927
-
report
https://access.redhat.com/security/cve/CVE-2026-76928
-
report
https://access.redhat.com/security/cve/CVE-2026-95387
-
report
https://access.redhat.com/security/cve/CVE-2026-95389
-
report
https://bugzilla.redhat.com/2520079
-
report
https://bugzilla.redhat.com/2520088
-
report
https://bugzilla.redhat.com/2520093
-
report
https://bugzilla.redhat.com/2520098
-
report
https://bugzilla.redhat.com/2520100
-
report
https://bugzilla.redhat.com/2520103
-
report
https://bugzilla.redhat.com/2543033
-
report
https://bugzilla.redhat.com/2543037
-
advisory
https://errata.almalinux.org/10/ALSA-2026-84721.html