Critical Security Update for Wireshark: Addressing Heap-based Buffer Overflow and Path Traversal Vulnerabilities
Summary
ALSA-2026:20600: Important: wireshark security update. Affects wireshark versions < 1:4.4.2-10.el10_2. Fixed in 1:4.4.2-10.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely used network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It is essential for network troubleshooting, analysis, software and communications protocol development, and education. However, recent vulnerabilities have been identified that could compromise the security of systems using Wireshark.
Vulnerability Detail
The vulnerabilities in Wireshark include a heap-based buffer overflow (CVE-2026-5405) and an improper limitation of a pathname to a restricted directory, known as path traversal (CVE-2026-5656). The heap-based buffer overflow could allow an attacker to execute arbitrary code on the affected system, while the path traversal vulnerability could enable unauthorized access to files outside the intended directory. Both vulnerabilities pose significant risks, especially in environments where sensitive data is transmitted over networks.
How To Fix
Minimum fixed version
1:4.4.2-10.el10_2
This is the first release that contains the fix.
sudo dnf update wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of Wireshark by restricting access to the application and ensuring that it is only run in trusted environments until the update can be applied.
Conclusion
The vulnerabilities in Wireshark present serious security risks that must be addressed promptly. By updating to the latest patched version, users can protect their systems from potential exploits. It is crucial to remain vigilant and monitor for any further vulnerabilities in open-source software.
See every vulnerability recorded for wireshark →
FAQ
Wireshark is a network protocol analyzer that captures and displays the data traveling over a network in real-time.
The identified vulnerabilities could allow attackers to execute arbitrary code or gain unauthorized access to sensitive files, leading to potential data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If you cannot update immediately, ensure that Wireshark is only used in secure environments and limit access to the application until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
