CVE-2026-95387

Analyzed Analyzed - Analysis Complete

SPDY Protocol Dissector Crash in Wireshark

Publication date: 2026-09-29

Last updated on: 2026-10-08

Assigner: GitLab Inc.

Description

SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95387

EUVD

EUVD-2026-88703

Affected Vendors & Products

Vendor	Product	Version / Range
wireshark	wireshark	From 4.4.0 (inc) to 4.4.19 (exc)
wireshark	wireshark	From 4.6.0 (inc) to 4.6.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

CVE-2026-95387 is a high-severity integer overflow vulnerability in Wireshark's SPDY dissector that causes a heap buffer overflow. It occurs when a uint32_t variable accumulates fragment lengths without overflow protection in the spdy_assemble_data_frames() function. When the total exceeds 2^32 bytes, the value wraps to a small number, leading to an undersized buffer allocation. Subsequent memory operations corrupt the heap and crash Wireshark.

Detection Guidance

To detect this vulnerability, monitor for crashes in Wireshark when processing SPDY traffic. Use Wireshark's built-in dissector to analyze network captures for malformed SPDY DATA frames. Check for crashes or heap corruption when opening pcap files with large SPDY payloads.

Impact Analysis

This vulnerability can be triggered by opening a malicious packet trace file or receiving a malformed SPDY packet, causing Wireshark to crash. While no known exploits exist, the overflow could potentially allow arbitrary code execution. Attackers could craft a pcap file (~4 GB) with specific SPDY DATA frames to exploit this issue, leading to denial of service or system compromise.

Compliance Impact

This vulnerability primarily causes denial of service by crashing Wireshark, which could disrupt network monitoring and analysis. For GDPR, it may impact data integrity and availability if Wireshark is used for logging or forensic analysis. HIPAA compliance could be affected if the tool is used in healthcare environments for packet inspection, as crashes may lead to incomplete or corrupted data handling.

Mitigation Strategies

Upgrade Wireshark to version 4.6.9 or 4.4.19 or later. Avoid opening untrusted pcap files or processing suspicious network traffic. Disable SPDY dissector if not needed. Monitor for crashes or unusual behavior in Wireshark.

Hi! I’m here to help you understand CVE-2026-95387. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70