RHSA-2026:83657MediumCVSS 6.5

Red Hat Security Advisory: wireshark security update

Published
October 15, 2026
Last Modified
October 19, 2026

🔗 CVE IDs covered (4)

CVE-2026-76880 →CVE-2026-76886 →CVE-2026-76919 →CVE-2026-76927 →

📋 Description

CVE-2026-76880 — wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write CVE-2026-76886 — wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash CVE-2026-76919 — wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector CVE-2026-76927 — wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector

🎯 Affected products47

  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux CRB (v. 8)
  • wireshark-1:2.6.2-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-1:2.6.2-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-1:2.6.2-21.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-1:2.6.2-21.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-1:2.6.2-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-cli-1:2.6.2-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-cli-1:2.6.2-21.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-cli-1:2.6.2-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-cli-1:2.6.2-21.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-cli-1:2.6.2-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-cli-debuginfo-1:2.6.2-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-cli-debuginfo-1:2.6.2-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • wireshark-cli-debuginfo-1:2.6.2-21.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-cli-debuginfo-1:2.6.2-21.el8_10.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • wireshark-cli-debuginfo-1:2.6.2-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-cli-debuginfo-1:2.6.2-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)
  • wireshark-cli-debuginfo-1:2.6.2-21.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-cli-debuginfo-1:2.6.2-21.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)
  • wireshark-cli-debuginfo-1:2.6.2-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-cli-debuginfo-1:2.6.2-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • wireshark-debuginfo-1:2.6.2-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-debuginfo-1:2.6.2-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • wireshark-debuginfo-1:2.6.2-21.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-debuginfo-1:2.6.2-21.el8_10.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • wireshark-debuginfo-1:2.6.2-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-debuginfo-1:2.6.2-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)
  • wireshark-debuginfo-1:2.6.2-21.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • wireshark-debuginfo-1:2.6.2-21.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)
  • +17 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, avoid opening untrusted capture files or analyzing untrusted live network traffic with Wireshark. Users should only process network data from trusted sources to prevent potential denial of service attacks. Workaround: Do not populate the C12.22 decryption table, and disable the c1222.decrypt preference if crypto verification is not required. Avoid opening untrusted capture files or capturing C12.22 (TCP/1153) traffic from untrusted networks. If the C12.22 dissector is unused, disable it in protocol preferences. Workaround: To mitigate this issue prior to patching, disable the ESS protocol dissector by running tshark --disable-protocol ess or unchecking ESS under Analyze > Enabled Protocols. Additionally, avoid opening packet capture files from untrusted sources and restrict live capture to trusted networks using host firewalls. On systems where packet analysis is non-essential, remove the wireshark package entirely or restrict execution permissions strictly to authorized administrators. Workaround: To mitigate this issue, disable the H.245 protocol dissector by running tshark --disable-protocol h245 or unchecking H.245 under Analyze > Enabled Protocols. Additionally, avoid opening packet capture files from untrusted sources and restrict live capture to trusted networks using host firewalls. On systems where packet analysis is non-essential, remove the wireshark package entirely or restrict execution permissions strictly to authorized administrators.

🔗 References (7)