CVE-2025-13945: Wireshark HTTP3 Dissector DOS Vulnerability

CVE-2025-13945 Overview

CVE-2025-13945 is a denial-of-service vulnerability in the HTTP/3 dissector shipped with Wireshark 4.6.0 and 4.6.1. A malformed capture file or crafted packet stream processed by the affected dissector triggers a crash in the Wireshark process. The flaw is categorized under CWE-1325, which covers improperly controlled sequential memory allocation. Exploitation requires local access and user interaction, typically opening a malicious capture file or running a live capture that includes attacker-supplied HTTP/3 traffic. The result is loss of availability for the analyst's Wireshark session, but no confidentiality or integrity impact.

Critical Impact
An attacker who can deliver a crafted HTTP/3 packet capture to a Wireshark user can crash the application, disrupting network analysis workflows.

Affected Products

Wireshark 4.6.0
Wireshark 4.6.1
HTTP/3 dissector component (epan/dissectors/packet-http3.c)

Discovery Timeline

2025-12-03 - CVE-2025-13945 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13945

Vulnerability Analysis

The defect resides in the HTTP/3 dissector inside Wireshark's protocol analysis engine (epan). Wireshark dissectors parse packet bytes and reconstruct application-layer structures for display. When the HTTP/3 dissector encounters certain malformed frames, its memory-allocation logic fails to bound the operation correctly, leading to a crash of the dissection engine and termination of the Wireshark or TShark process. The Wireshark project documents the defect in Security Advisory WNPA-SEC-2025-07 and tracks the fix in GitLab issue 20860.

Root Cause

The root cause is improperly controlled sequential memory allocation [CWE-1325] within the HTTP/3 dissector. When length fields or frame counters in an HTTP/3 message are not validated against realistic bounds, the dissector performs allocations or iterations that exhaust resources or reach an unrecoverable state. The dissection engine then aborts, tearing down the parent process.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a .pcap or .pcapng file containing malformed HTTP/3 frames and delivers it to an analyst through email, a shared drive, or a public malware sample repository. Opening the file in Wireshark or replaying it through TShark triggers the crash. The same vector applies during live capture if attacker-controlled HTTP/3 traffic reaches an interface that Wireshark is monitoring.

No verified public exploit code is available. Refer to WNPA-SEC-2025-07 and the upstream GitLab issue for technical details.

Detection Methods for CVE-2025-13945

Indicators of Compromise

Unexpected termination of wireshark.exe, Wireshark, or tshark processes shortly after opening a capture file or starting a live capture.
Operating-system crash reports or Windows Error Reporting entries referencing the Wireshark binary or the epan dissection library.
Presence of unsolicited .pcap or .pcapng files delivered through email attachments, chat platforms, or file shares.

Detection Strategies

Inventory endpoints running Wireshark and identify installations reporting version 4.6.0 or 4.6.1 through software asset management.
Alert on Wireshark or TShark process crashes on analyst workstations, correlating with recent file-open events.
Inspect delivered capture files with a patched build or an alternative parser before analysts open them.

Monitoring Recommendations

Forward endpoint process telemetry and crash events from analyst systems to a centralized log platform.
Track file-write events for .pcap and .pcapng files arriving from external sources and quarantine unverified samples.
Monitor package repositories and internal software distribution channels for the rollout status of Wireshark 4.6.2 or later.

How to Mitigate CVE-2025-13945

Immediate Actions Required

Upgrade Wireshark to a version released after 4.6.1 that includes the fix referenced in WNPA-SEC-2025-07.
Instruct analysts to avoid opening untrusted capture files with vulnerable Wireshark builds.
Isolate malware-analysis and packet-inspection workflows to non-production systems until patching completes.

Patch Information

The Wireshark Foundation has addressed the defect in the HTTP/3 dissector. Consult Wireshark Security Advisory WNPA-SEC-2025-07 for the fixed release version and the associated GitLab issue 20860 for commit-level detail. Package maintainers for Linux distributions should track upstream releases and rebuild affected packages.

Workarounds

Disable the HTTP/3 dissector in Wireshark preferences under Analyze → Enabled Protocols when patching is delayed.
Perform initial triage of untrusted captures with command-line tools such as capinfos or a non-vulnerable parser instead of the Wireshark GUI.
Restrict Wireshark execution on analyst workstations to standard user accounts to limit the blast radius of a crash.

bash

# Disable the HTTP/3 dissector via TShark on a per-invocation basis
tshark -o "http3.enabled:FALSE" -r suspect_capture.pcapng

# Verify the installed Wireshark version before opening untrusted captures
wireshark --version | head -n 1