CVE-2022-4345 in Wireshark
Summary
by MITRE • 01/12/2023
Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/07/2026
The vulnerability identified as CVE-2022-4345 represents a critical denial of service weakness affecting Wireshark versions 3.6.0 through 3.6.9 and 4.0.0 through 4.0.1. This issue stems from infinite loop conditions present in the dissector implementations for Bundle Protocol version 6 BPv6 OpenFlow and Kafka protocols within the network traffic analysis tool. The flaw specifically manifests when these dissectors encounter malformed or specially crafted packets during protocol analysis, causing the application to enter indefinite looping states that consume excessive system resources and ultimately render the tool unusable.
The technical root cause of this vulnerability lies in the insufficient input validation and error handling mechanisms within the protocol dissector code for each affected protocol. When Wireshark processes packets containing malformed headers or unexpected data structures specific to BPv6 OpenFlow or Kafka protocols, the dissector functions fail to properly terminate execution or handle exceptional conditions. This results in recursive or iterative processing that continues indefinitely until system resources are exhausted. The vulnerability is particularly concerning because it can be triggered through multiple attack vectors including network packet injection or by loading maliciously crafted capture files that contain the problematic protocol data structures.
The operational impact of this vulnerability extends beyond simple service disruption to encompass significant security implications for network analysis operations. Organizations relying on Wireshark for network monitoring, troubleshooting, and security analysis face potential operational downtime when attackers exploit this weakness. The denial of service condition affects not only the analyst's ability to perform network traffic analysis but also creates potential opportunities for attackers to disrupt network operations or avoid detection by consuming system resources needed for legitimate monitoring activities. This vulnerability directly impacts the availability and reliability of network analysis tools that security teams depend upon for critical infrastructure monitoring and incident response activities.
Mitigation strategies for CVE-2022-4345 focus primarily on immediate version upgrades to patched releases of Wireshark where the dissector implementations have been corrected to properly handle malformed input data. Security administrators should prioritize updating to Wireshark versions that contain fixes for the infinite loop conditions in the affected protocol dissectors. Additionally, network administrators can implement temporary network segmentation or traffic filtering to prevent malicious packets from reaching systems running vulnerable Wireshark versions. The vulnerability aligns with CWE-835 which specifically addresses infinite loops in software implementations and represents a classic example of how insufficient input validation can create denial of service conditions. Organizations should also consider implementing monitoring solutions to detect unusual resource consumption patterns that may indicate exploitation attempts. This vulnerability demonstrates the importance of robust input validation and proper error handling in network protocol analysis tools, particularly those handling complex binary protocols where malformed data can trigger unexpected execution paths. The ATT&CK framework categorizes this as a denial of service technique where adversaries leverage software weaknesses to disrupt availability of network analysis capabilities, potentially masking their activities or causing operational disruptions in security operations centers.