CVE-2026-6520: 
Wireshark vulnerability analysis and mitigation

CVE-2026-6520 is an infinite loop vulnerability in Wireshark's OpenFlow v6 protocol dissector that allows unauthenticated attackers to cause a denial of service. It affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The vulnerability was published on April 30, 2026, with patches available in versions 4.6.5 and 4.4.15. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, though the GitHub Advisory Database rates it 5.5 (Moderate) using a local attack vector (GitHub Advisory, Wireshark Advisory).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition), where the OpenFlow v6 protocol dissector enters an infinite loop when processing a specially crafted packet, never reaching a valid exit condition. An attacker can exploit this by injecting or replaying a malicious OpenFlow v6 packet into a network being monitored by Wireshark, or by supplying a crafted pcap file for offline analysis. The precondition for network-based exploitation is that Wireshark must be actively capturing or dissecting traffic containing OpenFlow v6 packets; for file-based exploitation, a user must open a malicious pcap file. A proof-of-concept pcap file and reproduction steps have been publicly documented in the Wireshark issue tracker (Wireshark Issue, GitHub Advisory).

Successful exploitation causes Wireshark to enter an infinite loop, effectively crashing or hanging the application and preventing any further packet analysis. The impact is limited to availability — there is no confidentiality or integrity impact, and the vulnerability does not enable code execution or lateral movement. Affected users include network analysts and security operations teams relying on Wireshark for real-time traffic inspection or forensic pcap analysis (Wireshark Advisory, GitHub Advisory).

A proof-of-concept exploit in the form of a malicious pcap file (p2-43174-openflow_v6.pcapng) is publicly available via the Wireshark GitLab issue tracker, with explicit reproduction steps confirmed as a high-confidence, real exploit (Wireshark Issue). There is no evidence of active in-the-wild exploitation as of the time of reporting, and no threat actor attribution has been made. The EPSS score is approximately 0.013% (0.000130), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Prepare the malicious pcap: Obtain or craft a specially malformed OpenFlow v6 pcap file (e.g., p2-43174-openflow_v6.pcapng) that triggers the infinite loop condition in Wireshark's dissector.
2. Deliver the pcap: Either share the malicious pcap file with a target analyst (social engineering) or inject the malformed OpenFlow v6 packets into a network segment being actively monitored by a vulnerable Wireshark instance.
3. Trigger dissection: For file-based exploitation, instruct or wait for the target to open the pcap in Wireshark or run: tshark -r p2-43174-openflow_v6.pcapng -o ip.defragment:FALSE -n. For live capture, ensure the malformed packets traverse the monitored interface.
4. Achieve DoS: The OpenFlow v6 dissector enters an infinite loop while processing the malformed packet, causing Wireshark/tshark to hang indefinitely and consume 100% CPU, effectively denying packet analysis capability (Wireshark Issue).

• Process: Wireshark or tshark process consuming 100% CPU indefinitely without completing dissection; process becomes unresponsive to user input.
• Network: Unusual OpenFlow v6 packets with malformed or truncated fields on monitored network segments, particularly on TCP port 6653 (OpenFlow default).
• File System: Presence of unexpected or externally supplied pcap files (e.g., files named similarly to p2-43174-openflow_v6.pcapng) in analyst workstations or shared analysis directories.
• Logs: System logs showing Wireshark/tshark process killed by the OS due to resource exhaustion or manual termination after hanging; no normal dissection output produced (Wireshark Issue).

Wireshark has released patched versions 4.6.5 and 4.4.15, which resolve this vulnerability; users should upgrade immediately (Wireshark Advisory, Release Notes). As a workaround, administrators can disable OpenFlow v6 protocol dissection in Wireshark preferences if it is not required for operations. Additionally, restricting the sources of pcap files opened by analysts and limiting network exposure of Wireshark instances can reduce risk. Linux distribution packages (Debian, SUSE) have also begun shipping updated packages addressing this CVE.

Wireshark announced the fix via its official mailing lists in April and May 2026, and the vulnerability received coverage from security news outlets including CyberSecurityNews and Heise (CyberSecurityNews, Heise). Tenable published multiple Nessus detection plugins (IDs 311698, 313009, 318251) to identify vulnerable Wireshark installations. Community reaction has been measured, with the vulnerability noted as a DoS-only issue with no code execution potential, and patches being promptly distributed through major Linux distributions.