CVE-2026-5401: 
Wireshark vulnerability analysis and mitigation

CVE-2026-5401 is a denial-of-service vulnerability in Wireshark's AFP (Apple Filing Protocol) Spotlight protocol dissector caused by uncontrolled recursion (CWE-674). It affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, and was published on April 30, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), with the primary impact being high availability loss (GitHub Advisory, Wireshark Advisory).

The root cause is uncontrolled recursion (CWE-674) in Wireshark's AFP Spotlight protocol dissector, which fails to properly limit recursive processing depth when handling malformed AFP Spotlight protocol packets. An attacker can trigger a stack overflow crash in Wireshark or tshark by sending crafted malformed AFP Spotlight packets over TCP port 548, or by tricking a user into opening a specially crafted PCAP file containing such packets. Exploitation requires local user interaction — the victim must open a malicious capture file or be monitoring traffic containing the malformed packets. A proof-of-concept has been published on the Wireshark GitLab issue tracker, including Python scripts (generate_afp_spotlight.py and afp_spotlight_send.py) and sample PCAP files that reliably reproduce the crash (Wireshark GitLab, GitHub Advisory).

Successful exploitation causes Wireshark or tshark to crash, resulting in a denial of service that renders the packet analysis tool unavailable. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. The attack scope is unchanged, meaning only the Wireshark process itself is affected, with no potential for lateral movement or privilege escalation (GitHub Advisory, Wireshark Advisory).

A public proof-of-concept exploit is available on the Wireshark GitLab issue tracker, including concrete reproduction steps and Python scripts that reliably crash tshark (Wireshark GitLab). As of the time of reporting, there is no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify a target running a vulnerable version of Wireshark (4.4.0–4.4.14 or 4.6.0–4.6.4) that is actively capturing or analyzing network traffic, or can be induced to open a PCAP file.
2. Generate malformed packets: Use the publicly available generate_afp_spotlight.py script to create malformed AFP Spotlight protocol packets designed to trigger uncontrolled recursion in the dissector.
3. Deliver the payload (two options):
   • Network-based: Run sudo ../.venv/bin/python3 afp_spotlight_send.py 127.0.0.1 (or target IP) to send the malformed packets over TCP port 548 to a host being monitored by Wireshark/tshark.
   • File-based: Package the malformed packets into a PCAP file and trick the target user into opening it with Wireshark.
4. Trigger crash: The AFP Spotlight dissector enters uncontrolled recursion when processing the malformed packet structure, causing a stack overflow and crashing the Wireshark or tshark process (Wireshark GitLab).

• Network: Unexpected TCP connections or traffic on port 548 (AFP) from untrusted or external hosts, particularly with unusual packet structures or abnormally large/nested payloads.
• Process: Wireshark or tshark process terminating unexpectedly with a segmentation fault or stack overflow error; repeated crashes of the dissector process.
• Logs: Crash reports or core dumps generated by Wireshark/tshark referencing the AFP Spotlight dissector; system logs showing abnormal process exits (e.g., signal 11/SIGSEGV) from wireshark or tshark binaries.
• File System: Presence of unexpected PCAP files in user directories containing AFP Spotlight protocol traffic from untrusted sources.

Wireshark has released patched versions 4.4.15 and 4.6.5 that address this vulnerability; users should upgrade immediately (Wireshark Advisory, Release Notes). As a workaround, users should avoid opening untrusted PCAP files or capturing traffic from untrusted sources that may contain AFP Spotlight protocol packets. If AFP Spotlight protocol dissection is not required for analysis workflows, consider disabling the dissector within Wireshark's protocol preferences. Linux distribution packages (Debian, SUSE, etc.) are also being updated through their respective security channels.

The Wireshark project issued a security advisory (wnpa-sec-2026-13) and announced patched releases via their mailing lists (Wireshark Announce). Security news outlets including CyberSecurityNews covered the broader set of Wireshark vulnerabilities disclosed alongside CVE-2026-5401. Tenable published Nessus detection plugins (IDs 313009 and 318251) for the vulnerability. No significant social media controversy or notable individual researcher commentary has been identified beyond standard vulnerability tracking and patch announcements.