Wireshark's TLS protocol dissector contains an infinite loop that can be triggered when parsing certain TLS packets. This causes the application to hang and consume system resources until a user intervenes, resulting in a denial of service that affects the availability of the network analysis workflow and can disrupt monitoring activities where Wireshark is used for live traffic inspection.

Version 4.6.0 through 4.6.4 of Wireshark released by the Wireshark Foundation are affected. All installations of these releases running on any supported platform are potentially vulnerable.

The reported CVSS score of 5.5 indicates a moderate severity. The EPSS score is 0.00012, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, a crafted TLS packet sent over a network connection to the target Wireshark instance can trigger the infinite loop, so the likely attack vector is remote traffic sent to an unattended or untrusted Wireshark session. An attacker who can inject such traffic could abruptly disrupt a monitoring session, especially if Wireshark is processing untrusted capture files or network traffic.