Description
UDS protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Published: 2026-04-30
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is an infinite loop triggered in the UDS protocol dissector, leading to a denial of service. The flaw is classified as CWE-835. When a crafted packet exercises this loop, Wireshark becomes unresponsive, disrupting its availability. The issue does not provide a path to privilege escalation or data leakage.

Affected Systems

Wireshark Foundation’s Wireshark software in versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 is affected. Any installation within these ranges is vulnerable.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers likely need the Wireshark process to parse a UDS packet, which could occur via a locally crafted pcap file or during a live capture of traffic that contains the packet. No public exploits are known, but the ability to supply such traffic would cause the application to hang and could be used to disrupt analysis workflows.

Generated by OpenCVE AI on April 30, 2026 at 13:54 UTC.

Remediation

Vendor Solution

Upgrade to version 4.6.5 or above

OpenCVE Recommended Actions

  • Upgrade Wireshark to version 4.6.5 or later
  • If upgrading immediately is not possible, avoid opening pcap files that may contain UDS packets until a patch is applied
  • Use unpatched Wireshark only for non‑critical analysis and isolate the environment to limit service disruption

Generated by OpenCVE AI on April 30, 2026 at 13:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 30 Apr 2026 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Wireshark
Wireshark wireshark
Vendors & Products Wireshark
Wireshark wireshark

Thu, 30 Apr 2026 05:30:00 +0000

Type Values Removed Values Added
Description UDS protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Title Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
Weaknesses CWE-835
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Wireshark Wireshark
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-04-30T15:21:26.890Z

Reserved: 2026-04-29T07:34:01.353Z

Link: CVE-2026-7375

cve-icon Vulnrichment

Updated: 2026-04-30T14:47:34.394Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-04-30T06:16:16.927

Modified: 2026-04-30T15:13:14.230

Link: CVE-2026-7375

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-30T05:04:15Z

Links: CVE-2026-7375 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T14:00:22Z

Weaknesses