CVE-2026-6520
OpenFlow v6 Protocol Infinite Loop in Wireshark
Publication date: 2026-04-30
Last updated on: 2026-05-01
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wireshark | wireshark | From 4.4.0 (inc) to 4.4.14 (inc) |
| wireshark | wireshark | From 4.6.0 (inc) to 4.6.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the CVE-2026-6520 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-6520 is an infinite loop vulnerability in the OpenFlow v6 protocol dissector of Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14.
The issue arises from improper validation of a length value (`prop_len`) in the `dissect_openflow_bundle_prop_v6()` function, specifically in the `OFPBPT_TIME` case. When `prop_len` is less than 4, an unsigned subtraction causes a wraparound to a large positive number, making a loop condition never terminate.
This infinite loop can be triggered by a maliciously crafted packet or a specially crafted packet trace file, causing Wireshark to consume excessive CPU resources.
How can this vulnerability impact me? :
This vulnerability can cause a denial-of-service (DoS) condition by making Wireshark enter an infinite loop, leading to excessive CPU usage or application crash.
An attacker could exploit this by sending a malformed packet or tricking a user into opening a crafted packet trace file, which would trigger the infinite loop.
The impact is primarily on availability, as the affected Wireshark application may become unresponsive or crash, disrupting network analysis activities.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for excessive CPU usage in Wireshark when processing OpenFlow v6 packets or packet trace files. Specifically, the issue arises when Wireshark processes a malformed OpenFlow v6 packet that triggers an infinite loop in the dissector.
Detection can involve analyzing packet captures for malformed OpenFlow v6 packets that might exploit the underflow in the `prop_len` field within the `dissect_openflow_bundle_prop_v6()` function.
While no explicit commands are provided in the resources, you can use Wireshark or tshark to inspect OpenFlow v6 traffic and look for suspicious packets or traces that cause Wireshark to hang or consume excessive CPU.
- Use tshark to read packet capture files and observe CPU usage: `tshark -r suspicious_capture.pcap`
- Monitor system CPU usage when opening packet trace files in Wireshark to detect potential infinite loops.
What immediate steps should I take to mitigate this vulnerability?
The immediate and recommended mitigation step is to upgrade Wireshark to version 4.6.5, 4.4.15, or later, where this vulnerability has been fixed.
Avoid opening untrusted or suspicious packet trace files that may contain malformed OpenFlow v6 packets designed to trigger the infinite loop.
If upgrading immediately is not possible, consider restricting access to Wireshark or limiting the analysis of OpenFlow v6 traffic until the update can be applied.