CVE-2024-0207

wireshark: HTTP3 dissector crash via packet injection or crafted capture file

Loading…

Severity

Moderate

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · January 3, 2024

Updated · November 21, 2025

Description

A flaw was found in the HTTP3 dissector of Wireshark. It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

Statement

Red Hat Enterprise Linux 6, 7, 8 and 9 are not affected by this CVE as they shipped an older version of Wireshark that did not include the vulnerable code.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-125 · Out-of-bounds Read