{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-95387", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-09-22T05:34:01.677Z", "datePublished": "2026-09-29T09:33:13.021Z", "dateUpdated": "2026-09-29T15:50:45.375Z"}, "containers": {"cna": {"title": "Heap-based Buffer Overflow in Wireshark", "descriptions": [{"lang": "en", "value": "SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service"}], "affected": [{"vendor": "Wireshark Foundation", "product": "Wireshark", "repo": "https://gitlab.com/wireshark/wireshark", "versions": [{"version": "4.6.0", "status": "affected", "lessThan": "4.6.9", "versionType": "semver"}, {"version": "4.4.0", "status": "affected", "lessThan": "4.4.19", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "cweId": "CWE-122", "type": "CWE"}]}], "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2026-97.html"}, {"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21487"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.6.9 or above"}], "credits": [{"lang": "en", "value": "Security research assessment of Wireshark internals (Feng Xue)", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-09-29T09:33:13.021Z"}}, "adp": [{"references": [{"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21487", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-29T15:50:16.910979Z", "id": "CVE-2026-95387", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T15:50:45.375Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Wireshark", "repo": "https://gitlab.com/wireshark/wireshark", "vendor": "Wireshark Foundation", "versions": [{"lessThan": "4.6.9", "status": "affected", "version": "4.6.0", "versionType": "semver"}, {"lessThan": "4.4.19", "status": "affected", "version": "4.4.0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service"}], "id": "CVE-2026-95387", "lastModified": "2026-09-29T10:17:14.713", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2026-09-29T10:17:14.713", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21487"}, {"source": "cve@gitlab.com", "url": "https://www.wireshark.org/security/wnpa-sec-2026-97.html"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "cve@gitlab.com", "type": "Primary"}]}

{"bugzilla": {"description": "wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector", "id": "2543033", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543033"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in Wireshark. The SPDY protocol dissector suffers from a heap-based buffer overflow due to improper handling of packet data. A remote attacker could exploit this vulnerability by injecting crafted network packets or enticing a user to inspect a malicious capture file, causing the application to crash and resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Disable the SPDY protocol dissector in Wireshark or TShark to prevent processing of the vulnerable protocol format.\nFor TShark command-line usage, pass the protocol disable flag:\n```\ntshark --disable-protocol spdy -r <capture_file>\n```\nFor persistent configuration across sessions, append the protocol to the disabled protocols file:\n```\necho \"spdy\" >> ~/.config/wireshark/disabled_protos\n```\nIn the Wireshark graphical interface:\n1. Navigate to Analyze -> Enabled Protocols...\n2. Search for \"SPDY\" and clear the checkbox.\n3. Click OK or Save.\nCaveat: Disabling the dissector prevents the decoding and inspection of SPDY protocol streams, treating them as generic TCP or TLS payload. Wireshark must be restarted if it is currently running for configuration changes to take effect. Always ensure capture analysis is conducted with non-privileged user privileges."}, "name": "CVE-2026-95387", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-29T09:33:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-95387\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-95387\nhttps://gitlab.com/wireshark/wireshark/-/work_items/21487\nhttps://www.wireshark.org/security/wnpa-sec-2026-97.html"], "threat_severity": "Important"}

{}