CVE-2026-0960
📋 TL;DR
This vulnerability in Wireshark's HTTP3 protocol dissector causes an infinite loop when processing specially crafted packets, leading to denial of service. It affects Wireshark users analyzing HTTP3 traffic, potentially causing the application to hang or crash.
💻 Affected Systems
- Wireshark
📦 What is this software?
Wireshark by Wireshark
Wireshark by Wireshark
⚠️ Risk & Real-World Impact
Worst Case
Wireshark becomes completely unresponsive, requiring process termination and potentially losing unsaved packet captures.
Likely Case
Wireshark hangs or crashes when encountering malicious HTTP3 traffic, disrupting network analysis activities.
If Mitigated
Limited impact as Wireshark restarts quickly, though analysis interruption occurs.
🎯 Exploit Status
Exploitation requires ability to send specially crafted HTTP3 packets to network being monitored.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.6.3 and later
Vendor Advisory: https://www.wireshark.org/security/wnpa-sec-2026-04.html
Restart Required: Yes
Instructions:
1. Download Wireshark 4.6.3 or later from wireshark.org. 2. Install over existing version. 3. Restart Wireshark and any related services.
🔧 Temporary Workarounds
Disable HTTP3 dissection
allTemporarily disable HTTP3 protocol dissection to prevent infinite loop
Edit preferences -> Protocols -> HTTP3 -> Uncheck 'Enable HTTP3 dissection'
🧯 If You Can't Patch
- Restrict network monitoring to trusted sources only
- Use network segmentation to isolate Wireshark systems from untrusted traffic
🔍 How to Verify
Check if Vulnerable:
Check Wireshark version via Help -> About Wireshark. If version is 4.6.0, 4.6.1, or 4.6.2, system is vulnerable.Check Version:
wireshark --versionVerify Fix Applied:
Verify version is 4.6.3 or later and test HTTP3 packet capture functionality.📡 Detection & Monitoring
Log Indicators:
- Wireshark process crashes or hangs
- High CPU usage by Wireshark without completion
Network Indicators:
- Malformed HTTP3 packets targeting monitored networks
SIEM Query:
ProcessName="wireshark" AND (EventID=1000 OR CPUUsage>90) AND Duration>30s