CVE-2026-95387: SPDY Protocol Dissector DoS Vulnerability

CVE-2026-95387 Overview

CVE-2026-95387 is a heap-based memory corruption flaw [CWE-122] in the Wireshark SPDY protocol dissector. Affected versions include Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. An attacker can trigger a dissector crash by injecting a malformed SPDY packet into a network capture that Wireshark parses, resulting in denial of service. Exploitation requires no authentication and can occur remotely when Wireshark reads live traffic or a crafted capture file.

Critical Impact
A single malformed SPDY frame processed by a vulnerable Wireshark instance can crash the analyzer, disrupting network monitoring, forensic analysis, and incident response workflows.

Affected Products

Wireshark 4.6.0 through 4.6.8
Wireshark 4.4.0 through 4.4.18
Any tool or workflow embedding the affected Wireshark dissector library (for example, tshark, dumpcap pipelines)

Discovery Timeline

2026-09-29 - CVE CVE-2026-95387 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-95387

Vulnerability Analysis

The flaw resides in the SPDY protocol dissector shipped with Wireshark. SPDY was an early HTTP/2 predecessor that Wireshark still parses for backward compatibility with legacy captures. When the dissector processes a crafted SPDY frame, it performs an unsafe heap operation that leads to memory corruption and process termination. Because Wireshark auto-detects SPDY frames on any TCP stream flagged as such, a single malformed packet in a .pcap or live capture triggers the crash without user interaction beyond opening the file or starting the capture.

The impact is denial of service against the analyst workstation or capture pipeline. In environments where Wireshark or tshark runs unattended for network telemetry, repeated malformed frames can prevent capture continuity and blind defenders during an attack.

Root Cause

The root cause is a heap-based buffer overflow [CWE-122] in the SPDY dissector's frame parsing logic. The dissector fails to enforce sufficient bounds validation on length fields extracted from the untrusted SPDY frame before performing memory operations on the associated heap buffer. See the Wireshark Security Advisory WNPA-SEC-2026-97 and the GitLab Wireshark Work Item for maintainer details.

Attack Vector

An attacker delivers a malformed SPDY frame in one of two ways. First, by injecting the frame into network traffic captured by a Wireshark instance operating in live capture mode. Second, by supplying a crafted .pcap or .pcapng file to an analyst who opens it in Wireshark or processes it with tshark. No credentials, prior access, or user interaction beyond normal capture analysis is required.

Refer to the Wireshark Security Advisory WNPA-SEC-2026-97 for the technical writeup and reproducer details.

Detection Methods for CVE-2026-95387

Indicators of Compromise

Unexpected termination of wireshark, tshark, or dumpcap processes during capture analysis.
Crash dumps or core files generated by Wireshark referencing the packet-spdy.c dissector or SPDY-related symbols.
Repeated malformed SPDY frames observed in packet captures on ports historically associated with SPDY traffic (for example, TCP 443 with NPN/ALPN spdy/3.1).

Detection Strategies

Inventory endpoints and analyst workstations running Wireshark and identify installs in the 4.6.0–4.6.8 and 4.4.0–4.4.18 ranges.
Correlate Wireshark or tshark process crashes with the timestamps of capture file imports to identify malicious pcap delivery.
Hunt for delivery of .pcap or .pcapng attachments to SOC analysts via email or shared drives when the sender is untrusted.

Monitoring Recommendations

Monitor host telemetry for abnormal exits of packet analysis binaries and generate alerts on repeated crashes within short intervals.
Log SHA-256 hashes of pcap files opened on analyst workstations to enable retroactive triage if a malicious sample is identified.
Track version metadata of Wireshark installations through endpoint software inventory to detect drift from patched baselines.

How to Mitigate CVE-2026-95387

Immediate Actions Required

Upgrade Wireshark to a fixed release above 4.6.8 on the 4.6 branch or above 4.4.18 on the 4.4 branch as published in WNPA-SEC-2026-97.
Restrict acceptance of externally sourced .pcap and .pcapng files until analyst systems are patched.
Do not open untrusted capture files with a vulnerable Wireshark build, even in isolated review workflows.

Patch Information

The Wireshark Foundation has addressed the issue in updated releases on both the 4.6 and 4.4 branches. Consult the Wireshark Security Advisory WNPA-SEC-2026-97 for the exact fixed version numbers and the GitLab Wireshark Work Item for the underlying code change.

Workarounds

Disable the SPDY dissector in Wireshark via Analyze → Enabled Protocols and unchecking SPDY until the patch is applied.
Route capture analysis through an isolated virtual machine or container that can be reverted after each session with untrusted pcaps.
Prefer command-line preview with capinfos over full dissection when triaging untrusted capture files.

bash

# Disable the SPDY dissector from the command line for tshark
tshark -o "spdy.desegment_multipart_ok:FALSE" \
       --disable-protocol spdy \
       -r suspicious.pcap

# Verify installed Wireshark version against the vulnerable ranges
wireshark --version | head -n 1