Z39.50 Protocol Dissector DoS in Wireshark

Executive Summary

This vulnerability is a crash in the Z39.50 protocol dissector component of Wireshark versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16. It allows an attacker to cause a denial of service by triggering the crash.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is a denial of service condition. An attacker can cause Wireshark to crash, potentially disrupting network analysis or monitoring activities.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-15170 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability can be triggered by a single Z39.50 response on TCP port 210 or by opening a crafted capture file in Wireshark or tshark.

To detect this vulnerability on your system, you can monitor network traffic on TCP port 210 for suspicious or malformed Z39.50 protocol packets.

Additionally, opening suspicious packet capture files in Wireshark or tshark versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 may trigger the crash, indicating the presence of the vulnerability.

Specific commands are not provided in the resources, but you can use tshark or tcpdump to capture traffic on port 210, for example:

• tcpdump -i <interface> tcp port 210 -w capture.pcap
• tshark -r capture.pcap -d tcp.port==210,z39.50

Opening the capture file in a vulnerable Wireshark or tshark version may reproduce the crash if malicious packets are present.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Wireshark to version 4.6.7, 4.4.17, or later, where the vulnerability has been fixed.

Avoid opening untrusted or suspicious packet capture files that may contain malformed Z39.50 protocol data.

If monitoring network traffic, consider filtering or blocking suspicious Z39.50 traffic on TCP port 210 to reduce exposure.

Useful 0 Not Useful 0