Description
AFP Spotlight protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Published: 2026-04-30
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An uncontrolled recursion bug, accompanied by a buffer management flaw (CWE‑1287), exists in the AFP Spotlight dissector of Wireshark. Maliciously crafted packets can trigger a crash when processed, resulting in a denial of service. The issue is identified as an input handling weakness that maps to both CWE‑674 (Uncontrolled Recursion) and CWE‑1287.

Affected Systems

Wireshark Foundation’s Wireshark application is affected. Versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14 are vulnerable. The issue is present in the AFP Spotlight dissector of these releases.

Risk and Exploitability

CVSS score of 5.5 indicates moderate impact. The EPSS score of 0.007% (equivalent to 7e-05) suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker supplying a crafted AFP Spotlight payload that Wireshark will parse locally, leading to a crash. No remote code execution or elevation is possible; the threat is limited to service disruption for the user.

Generated by OpenCVE AI on May 4, 2026 at 13:53 UTC.

Remediation

Vendor Solution

Upgrade to version 4.6.5 or above

OpenCVE Recommended Actions

  • Upgrade Wireshark to version 4.6.5 or newer.
  • If an upgrade cannot be performed immediately, restrict the use of Wireshark to trusted packet captures and avoid opening unknown AFP Spotlight files.
  • Consider sandboxing or running Wireshark within a separate virtual environment to contain potential crashes.

Generated by OpenCVE AI on May 4, 2026 at 13:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6249-1 wireshark security update
History

Mon, 04 May 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1287
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 01 May 2026 19:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*

Thu, 30 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Apr 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Wireshark
Wireshark wireshark
Vendors & Products Wireshark
Wireshark wireshark

Thu, 30 Apr 2026 06:30:00 +0000

Type Values Removed Values Added
Description AFP Spotlight protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Title Uncontrolled Recursion in Wireshark
Weaknesses CWE-674
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Wireshark Wireshark
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-04-30T13:00:48.178Z

Reserved: 2026-04-02T06:33:06.811Z

Link: CVE-2026-5401

cve-icon Vulnrichment

Updated: 2026-04-30T13:00:26.423Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-30T07:16:37.720

Modified: 2026-05-01T19:26:36.903

Link: CVE-2026-5401

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-30T05:39:09Z

Links: CVE-2026-5401 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-04T14:00:20Z

Weaknesses