Executive Summary

CVE-2026-6522 is an infinite loop vulnerability in the RPKI-Router protocol dissector of Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14. This flaw occurs when the dissector processes a malformed packet, specifically one with an all-0xFF payload, causing a function to return an extremely large length value. This triggers an infinite loop in the packet processing function because the offset arithmetic wraps around due to unsigned overflow, preventing the dissector from advancing properly and causing it to repeatedly attempt to process the oversized payload.

An attacker can exploit this by injecting a malformed packet into the network or tricking a user into opening a malicious packet trace file, leading to excessive CPU consumption and denial of service.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-6522 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial-of-service (DoS) condition by making Wireshark enter an infinite loop, consuming excessive CPU resources. This can crash the application or make it unresponsive, disrupting network analysis or monitoring activities.

Users who open malicious packet trace files or receive malformed packets on the network may experience these impacts, potentially affecting productivity or incident response capabilities.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability can be detected by observing Wireshark crashes or denial-of-service conditions when processing malformed RPKI-Router protocol packets, especially those with an all-0xFF payload.

A proof-of-concept pcap file exists that can reproduce the issue, which can be used to test if your Wireshark installation is vulnerable.

Using debugging tools like GDB to analyze Wireshark during packet dissection can reveal the infinite loop, as shown by a backtrace in the tcp_dissect_pdus() function.

No specific detection commands are provided in the resources.

Useful 0 Not Useful 0

Mitigation Strategies

Users should immediately upgrade Wireshark to versions 4.6.5 or 4.4.15 or later, as these versions contain fixes that prevent the infinite loop vulnerability in the RPKI-Router protocol dissector.

Avoid opening untrusted or suspicious packet trace files that might contain malformed RPKI-Router protocol packets.

Useful 0 Not Useful 0