CVE-2025-13499
📋 TL;DR
A vulnerability in Wireshark's Kafka dissector causes a crash when parsing malicious network packets, leading to denial of service. This affects Wireshark users analyzing Kafka protocol traffic in versions 4.6.0 and 4.4.0 through 4.4.10. The crash occurs during packet dissection and requires no authentication.
💻 Affected Systems
- Wireshark
📦 What is this software?
Wireshark by Wireshark
Wireshark by Wireshark
⚠️ Risk & Real-World Impact
Worst Case
Wireshark crashes repeatedly when processing malicious Kafka traffic, preventing network analysis and potentially disrupting monitoring workflows.
Likely Case
Wireshark crashes when encountering specially crafted Kafka packets, requiring restart and potentially losing unsaved capture data.
If Mitigated
With proper network segmentation and limited exposure, impact is minimal as only Wireshark instances analyzing Kafka traffic are affected.
🎯 Exploit Status
Exploitation requires sending malicious Kafka packets that Wireshark processes; no authentication needed as Wireshark analyzes captured traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.11 and 4.6.1
Vendor Advisory: https://www.wireshark.org/security/wnpa-sec-2025-06.html
Restart Required: Yes
Instructions:
1. Download latest Wireshark from wireshark.org. 2. Install over existing version. 3. Restart Wireshark and any related services.
🔧 Temporary Workarounds
Disable Kafka dissector
allPrevent Wireshark from parsing Kafka protocol traffic
Edit -> Preferences -> Protocols -> Kafka -> Uncheck 'Enable Kafka protocol'
Use capture filters
allFilter out Kafka traffic from captures
Capture -> Options -> Capture Filter: not port 9092
🧯 If You Can't Patch
- Restrict Wireshark use to trusted networks only
- Monitor for Wireshark crashes and investigate any Kafka traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check Wireshark version via Help -> About Wireshark; if version is 4.6.0 or between 4.4.0-4.4.10, you are vulnerable.Check Version:
wireshark --version | grep 'Wireshark'Verify Fix Applied:
Verify version is 4.4.11 or 4.6.1 or higher; test with Kafka traffic to ensure no crashes.📡 Detection & Monitoring
Log Indicators:
- Wireshark crash logs
- Application error events mentioning Wireshark
Network Indicators:
- Unusual Kafka traffic patterns to monitoring systems
- Multiple connection attempts on port 9092
SIEM Query:
EventID=1000 AND ProcessName='wireshark.exe' OR 'Wireshark crash' in ApplicationLogs