HTTP Protocol Dissector Crash in Wireshark

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-6868 is a vulnerability in Wireshark's HTTP protocol dissector that causes a crash due to a stack buffer overflow. The issue occurs when the HTTP dissector processes X.25 conversation paths and incorrectly accesses uninitialized memory, leading to out-of-bounds memory reads. This flaw happens in the dissect_http_tcp() function when it tries to access tcpinfo->flags without proper validation, resulting in a crash or memory corruption.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause Wireshark to crash when it processes specially crafted malformed packets or malicious packet trace files. An attacker could exploit this by sending malformed packets over the network or tricking a user into opening a malicious capture file, resulting in a denial of service (DoS) condition where Wireshark becomes unusable.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by analyzing network traffic or packet capture files using Wireshark's command-line tool tshark with a specially crafted malicious pcap file named poc_http_crash.pcapng.

Running tshark on this malicious pcap file triggers the vulnerability, causing a crash or AddressSanitizer stack-buffer-overflow error, which confirms the presence of the flaw.

Suggested command to test detection: tshark -r poc_http_crash.pcapng

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, users should upgrade Wireshark to version 4.6.5, 4.4.15, or later where the issue has been fixed.

Avoid opening untrusted or suspicious packet capture files that could exploit this flaw.

Useful 0 Not Useful 0