Summary
The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.
Security Fix(es):
* wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76886)
* wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write (CVE-2026-76880)
* wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector (CVE-2026-76919)
* wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76879)
* wireshark: Wireshark: Denial of Service via X.509IF protocol dissector crash (CVE-2026-76928)
* wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector (CVE-2026-76927)
* wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector (CVE-2026-95387)
* wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-95389)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | wireshark | 1:4.4.2-10.el10_2.8 |
Vulnerabilities 8
-
High 8.1
Heap-based Buffer Overflow in Wireshark
C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
High 8.1
Heap-based Buffer Overflow in Wireshark
SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
High 8.1
Heap-based Buffer Overflow in Wireshark
SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
High 7.5
Stack-based Buffer Overflow in Wireshark
C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
High 7.5
Out-of-bounds Write in Wireshark
RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
High 7.5
NULL Pointer Dereference in Wireshark
X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.3
Use of Uninitialized Variable in Wireshark
ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 4.7
NULL Pointer Dereference in Wireshark
H.245 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2520079
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2520088
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2520093
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2520098
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2520100
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2520103
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2543033
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2543037
-
advisory
https://access.redhat.com/errata/RHSA-2026:84721