CVE-2026-15171: 
Wireshark vulnerability analysis and mitigation

CVE-2026-15171 is a denial-of-service vulnerability in Wireshark's SSH protocol dissector that causes an application crash when processing malformed SSH traffic. It affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. The vulnerability was published on July 8, 2026, with patches available in versions 4.4.17 and 4.6.7. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Wireshark Advisory).

The root cause is a NULL Pointer Dereference (CWE-476) combined with Improper Validation of Syntactic Correctness of Input (CWE-1286) in Wireshark's SSH protocol dissector. An attacker can trigger the crash by supplying a specially crafted SSH packet or a malicious pcapng file containing a malformed SSH Decryption Secrets Block, causing the dissector to dereference a NULL pointer. Exploitation requires local access and user interaction — specifically, a user must open or analyze the crafted capture file or packet stream. A proof-of-concept is publicly available on the Wireshark GitLab issue tracker, including a Python script to generate the malicious payload and a Docker-based reproduction environment (Wireshark GitLab, GitHub Advisory).

Successful exploitation results in a crash of the Wireshark application, causing a denial of service with high availability impact. There is no impact to confidentiality or data integrity, and the scope is limited to the Wireshark process itself. A local, unprivileged user can trigger the crash without requiring any special privileges, simply by inducing a target user to open a crafted capture file (GitHub Advisory, Red Hat Bugzilla).

1. Craft malicious payload: Use the publicly available Python script from the GitLab issue to generate a crafted pcapng file containing a malformed SSH Decryption Secrets Block (e.g., python3 - <<'PY' import base64 open("poc","wb").write(base64.b64decode("OWFiY2QgADAxMjNMNTY3YWIAAABkMDE1NjcAIyBTcwAjIAAjIG9zCg==")) PY).
2. Deliver the file: Social-engineer or otherwise cause a target user running a vulnerable version of Wireshark (4.4.0–4.4.16 or 4.6.0–4.6.6) to open the crafted pcapng file (e.g., wireshark -r wireshark-ssh-keylog-null-deref.pcapng).
3. Trigger the crash: When Wireshark's SSH dissector processes the malformed Decryption Secrets Block, it dereferences a NULL pointer, causing the application to crash and resulting in a denial of service.
4. Verify impact: The Wireshark process terminates abnormally; no code execution or data exfiltration occurs — the impact is limited to application unavailability (Wireshark GitLab).

• File System: Presence of unexpected .pcapng files with malformed SSH Decryption Secrets Block content in user download or temp directories.
• Logs: Wireshark crash reports or core dump files generated in the user's home directory or system crash reporting paths (e.g., /var/crash/, Windows Event Log application errors referencing wireshark.exe).
• Process: Abnormal termination of the wireshark or tshark process with a segmentation fault or access violation signal, particularly when processing SSH capture files.

Users should upgrade Wireshark to version 4.4.17 or later (for the 4.4.x branch) or version 4.6.7 or later (for the 4.6.x branch), which contain the fix for this vulnerability. As a temporary workaround until patching is complete, avoid opening untrusted or unknown SSH capture files and restrict access to Wireshark on shared systems. Fedora and other Linux distributions have begun releasing updated packages incorporating the fix (Wireshark Advisory, GitHub Advisory).

Red Hat tracked the issue via Bugzilla (Bug 2498296) and classified it as medium severity, with the Red Hat Product Security team monitoring for downstream impact. Fedora issued updated Wireshark packages addressing this and related vulnerabilities. Security scanner vendors including Tenable (Nessus) and Qualys added detection plugins shortly after disclosure. Coverage was also noted on Linux security news outlets and the Kaspersky threat intelligence portal (Red Hat Bugzilla, Wireshark Advisory).