<Vulnerability name="CVE-2026-6523">
    <DocumentDistribution xml:lang="en">Copyright © 2012 Red Hat, Inc. All rights reserved.</DocumentDistribution>
    <ThreatSeverity>Moderate</ThreatSeverity>
    <PublicDate>2026-04-30T05:34:14</PublicDate>
    <Bugzilla id="2464043" url="https://bugzilla.redhat.com/show_bug.cgi?id=2464043" xml:lang="en:us">
wireshark: Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
    </Bugzilla>
    <CVSS3 status="draft">
        <CVSS3BaseScore>5.5</CVSS3BaseScore>
        <CVSS3ScoringVector>CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</CVSS3ScoringVector>
    </CVSS3>
    <CWE>CWE-835</CWE>
    <Details xml:lang="en:us" source="Red Hat">
A flaw was found in the GNW protocol dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing an infinite loop that leads to an excessive consumption of CPU resources, resulting in a denial of service.
    </Details>
    <Statement xml:lang="en:us">
This issue will cause a crash in Wireshark with no other security impact. Also, this flaw can only be exploited when a malformed pcap file is processed. Due to these reasons, this vulnerability has been rated with a moderate severity.
    </Statement>
    <Mitigation xml:lang="en:us">
If the GNW protocol dissector is not being used, it can be disabled via the "Enabled Protocols" dialog box in the Wireshark GUI application. This will also disable the protocol dissector when using "tshark", the command line tool.

See the links below for instructions to disable a protocol in Wireshark, specifically the "Control Protocol Dissection" section and the "disabled_protos" configuration file option.

https://www.wireshark.org/docs/wsug_html_chunked/ChCustProtocolDissectionSection.html
https://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html
    </Mitigation>
    <PackageState cpe="cpe:/o:redhat:enterprise_linux:10">
        <ProductName>Red Hat Enterprise Linux 10</ProductName>
        <FixState>Fix deferred</FixState>
        <PackageName>wireshark</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/o:redhat:enterprise_linux:6">
        <ProductName>Red Hat Enterprise Linux 6</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>wireshark</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/o:redhat:enterprise_linux:7">
        <ProductName>Red Hat Enterprise Linux 7</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>wireshark</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/o:redhat:enterprise_linux:8">
        <ProductName>Red Hat Enterprise Linux 8</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>wireshark</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/o:redhat:enterprise_linux:9">
        <ProductName>Red Hat Enterprise Linux 9</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>wireshark</PackageName>
    </PackageState>
    <References xml:lang="en:us">
https://www.cve.org/CVERecord?id=CVE-2026-6523
https://nvd.nist.gov/vuln/detail/CVE-2026-6523
https://gitlab.com/wireshark/wireshark/-/work_items/21177
https://www.wireshark.org/security/wnpa-sec-2026-38.html
    </References>
</Vulnerability>