CVE-2026-95387 in Wireshark
Summary
by MITRE • 09/29/2026
SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified involves a critical flaw within the SPDY protocol dissector found in Wireshark versions ranging from 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. This security issue manifests as an application crash, which directly facilitates a denial of service condition for users analyzing network traffic that includes SPDY packets. The root cause lies in the improper handling of specific malformed or unexpected data structures within the protocol parsing logic. When the dissector encounters these anomalous inputs during packet inspection, it fails to validate memory access boundaries correctly, leading to an unhandled exception that terminates the application process abruptly. This behavior is particularly dangerous because Wireshark is often used by security professionals and network administrators who rely on its stability for continuous monitoring and forensic analysis; a crash interrupts this workflow and can lead to data loss if unsaved capture files are involved.
From a technical perspective, this flaw aligns with CWE-20 Improper Input Validation, as the software does not adequately sanitize or verify the integrity of incoming SPDY stream data before processing it. The lack of robust boundary checks allows malformed packets to trigger memory corruption or illegal instruction execution within the dissector module. In terms of offensive security frameworks, this vulnerability maps closely to MITRE ATT&CK technique T1499 Endpoint Denial of Service, specifically under sub-techniques involving application exhaustion or resource consumption via crafted inputs. An attacker with the ability to inject SPDY traffic into a network segment where Wireshark is actively running can exploit this flaw remotely without authentication, simply by directing maliciously constructed packets toward the target machine. The impact extends beyond mere inconvenience; it undermines the reliability of security monitoring tools and can be used as part of a broader attack chain to disrupt incident response capabilities or hide other malicious activities by causing the analyst's tooling to fail repeatedly.
Mitigation strategies for this vulnerability primarily involve upgrading Wireshark to patched versions that address these parsing errors. Users should immediately transition to version 4.6.9 or later, as well as any subsequent releases in the 4.4.x branch beyond 4.4.18, where developers have implemented stricter input validation and error handling routines within the SPDY dissector. Until an upgrade is feasible, operators can mitigate risk by disabling the SPDY protocol dissector through Wireshark's preferences menu or by applying display filters that exclude SPDY traffic from analysis sessions. Additionally, organizations should enforce network segmentation policies to prevent untrusted sources from injecting high volumes of synthetic SPD4 packets into monitoring segments where security tools are deployed. Regular patch management and automated vulnerability scanning for endpoint security tooling are essential practices to ensure that such application-level flaws do not compromise the integrity of defensive operations.