CVE-2024-0207: Wireshark HTTP3 DoS Vulnerability

CVE-2024-0207 Overview

CVE-2024-0207 is a denial-of-service vulnerability in the HTTP/3 dissector of Wireshark 4.2.0. The flaw allows a remote attacker to crash the application by injecting malicious packets onto a monitored network or by tricking a user into opening a crafted capture file. The defect is tracked under CWE-125: Out-of-bounds Read and is documented in Wireshark Security Advisory wnpa-sec-2024-03. No authentication or user interaction is required when packet injection is used against a live capture.

Critical Impact
A single malformed HTTP/3 frame can terminate Wireshark, disrupting live traffic analysis and incident response workflows that rely on packet inspection.

Affected Products

Wireshark 4.2.0
Deployments using the HTTP/3 dissector during live capture
Forensic workflows opening untrusted .pcap or .pcapng files containing HTTP/3 traffic

Discovery Timeline

2024-01-03 - CVE-2024-0207 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0207

Vulnerability Analysis

The vulnerability resides in the HTTP/3 protocol dissector shipped with Wireshark 4.2.0. When the dissector processes a malformed HTTP/3 frame, it reads memory outside the bounds of the allocated packet buffer. The out-of-bounds read causes the Wireshark process to crash, producing a denial-of-service condition. The issue is tracked in the upstream project as GitLab issue 19502.

The flaw is reachable in two ways. An attacker on the same broadcast or routed network can inject crafted HTTP/3 packets that Wireshark dissects during a live capture. Alternatively, an analyst can be tricked into opening a malicious capture file that contains the same malformed frames. Both vectors lead to the same out-of-bounds read in the dissector.

Root Cause

The root cause is improper bounds validation inside the HTTP/3 dissector when parsing frame fields. The dissector advances its read pointer based on length values supplied by the packet without verifying that the requested range fits within the captured tvbuff. Reading past the buffer terminates the process through an unhandled exception path.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction in the live-capture scenario. An attacker injects a crafted HTTP/3 packet on a network segment that an analyst is monitoring. In the file-based scenario, the attacker delivers a crafted .pcapng capture to an analyst through email, file share, or a sample-sharing platform. Opening the file invokes the vulnerable dissector and crashes Wireshark.

No verified public proof-of-concept is available. The vulnerability mechanism is described in the upstream advisory referenced above.

Detection Methods for CVE-2024-0207

Indicators of Compromise

Unexpected termination of wireshark or tshark processes while capturing or replaying HTTP/3 traffic
Crash dumps referencing the HTTP/3 dissector module in Wireshark 4.2.0
Receipt of unsolicited .pcap or .pcapng files containing HTTP/3 streams from untrusted sources

Detection Strategies

Inventory installed Wireshark versions across analyst workstations and identify hosts running 4.2.0
Monitor endpoint telemetry for repeated crashes of wireshark.exe, tshark.exe, or their Linux equivalents during packet capture
Inspect HTTP/3 traffic on monitored segments for malformed frames that deviate from RFC 9114 framing rules

Monitoring Recommendations

Centralize Wireshark process exit codes and crash events in your SIEM or data lake for correlation
Alert on capture files received over email or chat that are then opened by Wireshark on analyst workstations
Track Wireshark version drift through software inventory tooling to prevent unpatched 4.2.0 installations from persisting

How to Mitigate CVE-2024-0207

Immediate Actions Required

Upgrade Wireshark to a release later than 4.2.0 that includes the fix referenced in wnpa-sec-2024-03
Avoid opening untrusted HTTP/3 capture files on workstations still running 4.2.0
Restrict live captures on segments where untrusted endpoints can inject HTTP/3 traffic until patching is complete

Patch Information

The Wireshark Foundation released a fixed build addressed in security advisory wnpa-sec-2024-03. The corresponding upstream fix is tracked in GitLab issue 19502. Administrators should deploy the patched version through their standard software distribution mechanism and verify the installed version after upgrade.

Workarounds

Disable the HTTP/3 dissector in Analyze > Enabled Protocols until the patched version is installed
Use tshark with explicit dissector exclusions when processing third-party capture files
Open suspicious capture files only inside an isolated virtual machine or sandbox

bash

# Verify installed Wireshark version and confirm patch status
wireshark --version
tshark --version

# Temporarily disable the HTTP/3 dissector for tshark sessions
tshark --disable-protocol http3 -r suspicious_capture.pcapng