Wireshark up to 4.4.14/4.6.4 AFP Spotlight Protocol Dissector recursion

Summaryinfo

A vulnerability was found in Wireshark up to 4.4.14/4.6.4 and classified as problematic. This affects an unknown part of the component AFP Spotlight Protocol Dissector. The manipulation results in recursion. This vulnerability is reported as CVE-2026-5401. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Wireshark up to 4.4.14/4.6.4. Affected is an unknown code of the component AFP Spotlight Protocol Dissector. The manipulation with an unknown input leads to a recursion vulnerability. CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. This is going to have an impact on availability. CVE summarizes:

AFP Spotlight protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

The weakness was disclosed by Brendan Coles as 21088. The advisory is shared for download at wireshark.org. This vulnerability is traded as CVE-2026-5401 since 04/02/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 313009 (Debian dsa-6249 : libwireshark-data - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.4.15 or 4.6.5 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (313009) and CERT Bund (WID-SEC-2026-1311). Once again VulDB remains the best source for vulnerability data.

Affected

• Open Source Wireshark

Productinfo

Type

• Packet Analyzer Software

Name

• Wireshark

Version

• 4.4.0
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 4.4.5
• 4.4.6
• 4.4.7
• 4.4.8
• 4.4.9
• 4.4.10
• 4.4.11
• 4.4.12
• 4.4.13
• 4.4.14
• 4.6.0
• 4.6.1
• 4.6.2
• 4.6.3
• 4.6.4

License

• open-source

Website

• Product: https://www.wireshark.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion