Description
Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Wireshark Foundation | Wireshark | >=4.0.0, <4.0.2, >=3.6.0, <3.6.10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wireshark | 4.0.2-1 | — |
| Debian 13 | wireshark | 4.0.2-1 | — |
| Debian 12 | wireshark | 4.0.2-1 | — |
| Debian 11 | wireshark | 3.4.16-0+deb11u1 | DLA-3906-1 |
| Debian 10 | wireshark | 2.6.20-0+deb10u5 | DLA-3313-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | wireshark | No fix yet | — |
| Ubuntu Pro 20.04 LTS | wireshark | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SLES 15 SP3 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SLES 15 SP2 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SLES 15 SP1 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SLES for SAP 15 SP2 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SLES for SAP 15 SP1 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SLE Real Time 15 SP3 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SLE HPC 15 SP3 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SLE HPC 15 SP2 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SLE HPC 15 SP1 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SUSE Manager Server 4.2 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SUSE Manager Retail Branch Server 4.2 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SUSE Manager Proxy 4.2 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SUSE Enterprise Storage 7.1 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SUSE Enterprise Storage 7 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
| SUSE Enterprise Storage 6 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | wireshark | 4.0.3-2.1 | openSUSE-SU-2024:12647-1 |
| openSUSE Leap 15.4 | wireshark | 3.6.11-150000.3.83.1 | SUSE-SU-2023:0343-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | wireshark-cli +1 | 1:4.0.3-1.amzn2023.0.1 | ALAS2023-2023-120 |
Advisories 7
- DLA-3906-1 wireshark - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3313-1 wireshark - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:0343-1 Security update for wireshark SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1424 Xerox FreeFlow Print Server für Solaris: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2025
- openSUSE-SU-2024:12647-1 libwireshark16-4.0.3-2.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2022-2260 Wireshark: Mehrere Schwachstellen ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 29, 2024
- ALAS2023-2023-120 Important: wireshark security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 8, 2023
References
- https://www.wireshark.org/security/wnpa-sec-2022-09.html
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4345.json
- [debian-lts-announce] 20230208 [SECURITY] [DLA 3313-1] wireshark security update mailing-list
- FEDORA-2023-9ddb9b9757 vendor-advisory
- FEDORA-2023-f9e2ad8b73 vendor-advisory