CVE-2026-95387

A flaw was found in Wireshark. The SPDY protocol dissector suffers from a heap-based buffer overflow due to improper handling of packet data. A remote attacker could exploit this vulnerability by injecting crafted network packets or enticing a user to inspect a malicious capture file, causing the application to crash and resulting in a Denial of Service (DoS).

Red Hat rates this vulnerability as Important rather than Moderate because heap-based memory corruption could permit arbitrary code execution in the context of the user analyzing traffic, rather than being strictly confined to application termination. On Red Hat Enterprise Linux, Wireshark and its associated utilities are not deployed as unattended system daemons by default. Exploitation therefore requires an analyst to actively process an untrusted packet capture file or monitor live traffic on a hostile network segment.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the SPDY protocol dissector in Wireshark or TShark to prevent processing of the vulnerable protocol format.

For TShark command-line usage, pass the protocol disable flag:

tshark --disable-protocol spdy -r <capture_file>

For persistent configuration across sessions, append the protocol to the disabled protocols file:

echo "spdy" >> ~/.config/wireshark/disabled_protos

In the Wireshark graphical interface:

1. Navigate to Analyze -> Enabled Protocols...
2. Search for "SPDY" and clear the checkbox.
3. Click OK or Save.

Caveat: Disabling the dissector prevents the decoding and inspection of SPDY protocol streams, treating them as generic TCP or TLS payload. Wireshark must be restarted if it is currently running for configuration changes to take effect. Always ensure capture analysis is conducted with non-privileged user privileges.