CVE-2026-15165

Analyzed Analyzed - Analysis Complete

TLS ECH Decryptor Crash in Wireshark Causes DoS

Publication date: 2026-07-08

Last updated on: 2026-07-10

Assigner: GitLab Inc.

Description

TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-10

Generated

2026-07-15

AI Q&A

2026-07-09

EPSS Evaluated

2026-07-14

NVD

CVE-2026-15165

Affected Vendors & Products

Vendor	Product	Version / Range
wireshark	wireshark	From 4.6.0 (inc) to 4.6.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a crash in the TLS ECH decryptor component of Wireshark versions 4.6.0 to 4.6.6. It causes the application to crash, resulting in a denial of service.

Impact Analysis

The impact of this vulnerability is a denial of service, meaning that Wireshark can be made to crash and become unavailable when processing certain TLS ECH data.

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-15165 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability can be detected by analyzing capture files that trigger the TLS ECH decryptor crash in Wireshark versions 4.6.0 to 4.6.6. A specially crafted capture file containing an embedded Decryption Secrets Block (DSB) can cause the crash when opened.

To detect the vulnerability, you can reproduce the issue by building tshark with AddressSanitizer (ASan) enabled and decoding a crafted input file that triggers the heap buffer overflow in the TLS dissector.

No direct network commands are provided to detect the vulnerability, but monitoring for crashes or abnormal behavior when opening capture files in affected Wireshark versions can indicate exploitation attempts.

Mitigation Strategies

The immediate mitigation step is to upgrade Wireshark to version 4.6.7 or later, where this vulnerability has been fixed.

Until the upgrade is applied, avoid opening untrusted or suspicious capture files that could contain specially crafted TLS ECH packets designed to trigger the crash.

Hi! I’m here to help you understand CVE-2026-15165. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70