CVE-2026-5409
Monero Protocol Dissector DoS in Wireshark
Publication date: 2026-04-30
Last updated on: 2026-05-01
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wireshark | wireshark | From 4.4.0 (inc) to 4.4.14 (inc) |
| wireshark | wireshark | From 4.6.0 (inc) to 4.6.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The CVE-2026-5409 vulnerability is a stack overflow issue in Wireshark's Monero protocol dissector caused by mutual recursion without a depth guard.
Specifically, the dissect_encoded_dictionary() and dissect_encoded_value() functions call each other recursively when processing nested structures, which leads to excessive stack usage and eventually a segmentation fault (crash) when the stack limit is exceeded.
This crash can be triggered automatically by Wireshark's heuristic Monero detection on any TCP port, requiring only a single TCP stream with enough segments to exploit the issue.
How can this vulnerability impact me? :
This vulnerability can cause Wireshark to crash (denial of service) when processing certain Monero protocol packets or malformed packet trace files.
An attacker could exploit this by sending specially crafted packets or providing malicious trace files, causing the application to terminate unexpectedly.
This may disrupt network analysis activities and could potentially be used to interrupt monitoring or forensic investigations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability is triggered automatically by Wireshark's heuristic Monero detection on any TCP port, requiring only a single TCP stream with 115 segments of 1400 bytes each to exploit.
Detection can involve monitoring for crashes or segmentation faults (SIGSEGV) in Wireshark when analyzing network traffic or packet trace files containing Monero protocol data.
Since the issue occurs during packet dissection, using Wireshark to open suspicious packet captures that include Monero traffic may reveal the vulnerability if Wireshark crashes.
No specific commands are provided in the resources, but capturing TCP streams with tools like tcpdump or tshark and then analyzing them with Wireshark could help detect the issue.
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate mitigation is to upgrade Wireshark to version 4.6.5 or 4.4.15 or later, where the vulnerability has been fixed.
Avoid opening untrusted or malformed packet trace files that may contain malicious Monero protocol data.
Monitor for any crashes in Wireshark related to Monero dissector usage and apply patches or updates promptly.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the CVE-2026-5409 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.