CVE-2020-13164 in Wireshark
Summary
by MITRE
In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. This was addressed in epan/dissectors/packet-nfs.c by preventing excessive recursion, such as for a cycle in the directory graph on a filesystem.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/07/2026
The vulnerability identified as CVE-2020-13164 represents a critical denial-of-service weakness within Wireshark's Network File System (NFS) protocol dissector. This flaw affected multiple versions of the popular network protocol analyzer, specifically targeting releases from 3.2.0 through 3.2.3, 3.0.0 through 3.0.10, and 2.6.0 through 2.6.16. The issue manifests when Wireshark processes network traffic containing NFS protocol data, particularly in scenarios involving complex directory structures that create cycles within the filesystem graph.
The technical root cause of this vulnerability lies in the improper handling of recursive directory traversal within the NFS dissector implementation. When Wireshark encounters an NFS packet that references a directory structure containing circular references or cycles, the dissector's recursive parsing function fails to properly track visited nodes, leading to infinite recursion. This recursive loop eventually consumes all available stack memory and causes the application to crash. The flaw is categorized under CWE-674, which specifically addresses Uncontrolled Recursion, and represents a classic example of a stack overflow condition that can be exploited to cause system instability.
From an operational perspective, this vulnerability presents significant risks to network monitoring and security analysis operations. Network administrators and security analysts who rely on Wireshark for network traffic analysis and forensic investigations could experience complete application crashes when processing legitimate network traffic containing problematic NFS data. The impact extends beyond simple service disruption as it can compromise ongoing network monitoring activities, potentially leading to gaps in security monitoring and analysis capabilities. The vulnerability affects both active network monitoring and offline packet analysis scenarios, making it particularly dangerous in production environments where continuous network visibility is critical.
The mitigation strategy for CVE-2020-13164 involves implementing proper recursion depth limiting and cycle detection mechanisms within the NFS dissector. The fix implemented in epan/dissectors/packet-nfs.c addresses this by preventing excessive recursion through the introduction of safeguards that detect and terminate recursive loops before they can consume system resources. This approach aligns with ATT&CK technique T1499.001, which covers network denial-of-service attacks, by ensuring that the application can gracefully handle malformed input data without crashing. Organizations should prioritize updating their Wireshark installations to versions that include this patch, as the vulnerability can be exploited remotely through the processing of captured network traffic without requiring any special privileges or user interaction. The fix demonstrates proper defensive programming practices that should be applied to all recursive algorithms in network protocol analyzers to prevent similar issues from occurring in other dissector components.