CVE-2026-6522: Wireshark RPKI-Router DoS Vulnerability

CVE-2026-6522 Overview

A denial of service vulnerability exists in Wireshark's RPKI-Router protocol dissector due to an infinite loop condition. This vulnerability affects Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14, allowing attackers to cause application hangs or crashes when processing specially crafted RPKI-Router protocol traffic.

Critical Impact
An attacker can trigger an infinite loop in the RPKI-Router protocol dissector by providing malformed packet data, causing Wireshark to become unresponsive and denying service to users performing network analysis.

Affected Products

Wireshark 4.6.0 to 4.6.4
Wireshark 4.4.0 to 4.4.14

Discovery Timeline

2026-04-30 - CVE CVE-2026-6522 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-6522

Vulnerability Analysis

This vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition), commonly known as an infinite loop vulnerability. The flaw resides within the RPKI-Router protocol dissector component of Wireshark. When processing malformed or specially crafted RPKI-Router protocol packets, the dissector enters a loop that cannot terminate under normal conditions, causing the application to hang indefinitely.

The attack requires local access, meaning an attacker must either have the ability to provide a malicious capture file to a victim or inject malicious packets into network traffic being captured. User interaction is required, as the victim must open a malicious capture file or actively capture network traffic containing the malicious packets.

Root Cause

The root cause is an infinite loop condition (CWE-835) in the RPKI-Router protocol dissector logic. The dissector fails to properly validate or handle certain malformed packet structures, causing it to enter a loop without a reachable exit condition. This typically occurs when parsing length fields or iterating over protocol elements where boundary conditions are not adequately checked.

Attack Vector

The vulnerability requires local access with user interaction. An attacker can exploit this vulnerability through several methods:

Malicious Capture File: Crafting a .pcap or .pcapng file containing malformed RPKI-Router protocol packets and convincing a user to open it in Wireshark
Live Capture Injection: Injecting malicious RPKI-Router protocol packets into a network segment being monitored by a Wireshark instance
File Share Attacks: Placing malicious capture files in shared directories commonly accessed by network administrators

When the vulnerable Wireshark instance processes the malformed RPKI-Router traffic, the infinite loop triggers, causing complete application unresponsiveness. The availability impact is high as the application becomes non-functional until forcibly terminated.

For technical details on the specific packet structures that trigger this condition, see the Wireshark Security Advisory WNPA-SEC-2026-42 and the GitLab Work Item #21186.

Detection Methods for CVE-2026-6522

Indicators of Compromise

Wireshark processes consuming 100% CPU on a single core without completing packet analysis
Wireshark application becoming unresponsive when opening specific capture files
Network capture files containing abnormal RPKI-Router protocol structures or malformed length fields
User reports of Wireshark freezing when analyzing traffic from specific network segments

Detection Strategies

Monitor for Wireshark processes with abnormally high CPU usage that persist beyond normal analysis timeframes
Implement file integrity monitoring for capture files in shared directories
Deploy endpoint detection to identify Wireshark hangs correlated with recently opened .pcap or .pcapng files
Use process monitoring to detect Wireshark instances that become unresponsive

Monitoring Recommendations

Enable process watchdog monitoring for Wireshark instances in production environments
Log and alert on Wireshark process terminations that occur after extended periods of high CPU usage
Monitor network traffic analysis workstations for signs of DoS conditions
Review capture file sources before analysis on critical systems

How to Mitigate CVE-2026-6522

Immediate Actions Required

Upgrade Wireshark to versions 4.6.5 or later, or 4.4.15 or later to address the infinite loop vulnerability
Avoid opening capture files from untrusted or unknown sources
Disable the RPKI-Router protocol dissector if not required for analysis work
Consider using network-isolated systems for analyzing potentially malicious capture files

Patch Information

The Wireshark development team has addressed this vulnerability in subsequent releases. Users should upgrade to the latest stable version beyond the affected ranges (4.6.0-4.6.4 and 4.4.0-4.4.14). Detailed patch information is available in the Wireshark Security Advisory WNPA-SEC-2026-42 and the associated GitLab Work Item #21186.

Workarounds

Disable the RPKI-Router protocol dissector by navigating to Analyze → Enabled Protocols and unchecking RPKI-Router
Use command-line filtering with TShark to exclude RPKI-Router traffic when immediate patching is not possible
Implement sandbox environments for analyzing untrusted capture files
Limit capture file analysis to isolated virtual machines that can be terminated if they become unresponsive

bash

# Disable RPKI-Router dissector via command line
tshark --disable-protocol rpkirtr -r capture.pcap

# Alternatively, create a disabled protocols file
echo "rpkirtr" >> ~/.config/wireshark/disabled_protos