RHSA-2026:84721HighCVSS 8.1

Red Hat Security Advisory: wireshark security update

Published
October 19, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (8)

CVE-2026-95387 →CVE-2026-95389 →CVE-2026-76879 →CVE-2026-76880 →CVE-2026-76886 →CVE-2026-76919 →CVE-2026-76927 →CVE-2026-76928 →

📋 Description

CVE-2026-76879 — wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash CVE-2026-76880 — wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write CVE-2026-76886 — wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash CVE-2026-76919 — wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector CVE-2026-76927 — wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector CVE-2026-76928 — wireshark: Wireshark: Denial of Service via X.509IF protocol dissector crash CVE-2026-95387 — wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector CVE-2026-95389 — wireshark: Heap-based Buffer Overflow in Wireshark

🎯 Affected products39

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • wireshark-1:4.4.2-10.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-1:4.4.2-10.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-1:4.4.2-10.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-1:4.4.2-10.el10_2.8.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-1:4.4.2-10.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-cli-1:4.4.2-10.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-cli-1:4.4.2-10.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-cli-1:4.4.2-10.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-cli-1:4.4.2-10.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-cli-debuginfo-1:4.4.2-10.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-cli-debuginfo-1:4.4.2-10.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • wireshark-cli-debuginfo-1:4.4.2-10.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-cli-debuginfo-1:4.4.2-10.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • wireshark-cli-debuginfo-1:4.4.2-10.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-cli-debuginfo-1:4.4.2-10.el10_2.8.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • wireshark-cli-debuginfo-1:4.4.2-10.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-cli-debuginfo-1:4.4.2-10.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • wireshark-debuginfo-1:4.4.2-10.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-debuginfo-1:4.4.2-10.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • wireshark-debuginfo-1:4.4.2-10.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-debuginfo-1:4.4.2-10.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • wireshark-debuginfo-1:4.4.2-10.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-debuginfo-1:4.4.2-10.el10_2.8.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • wireshark-debuginfo-1:4.4.2-10.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-debuginfo-1:4.4.2-10.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • wireshark-debugsource-1:4.4.2-10.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • wireshark-debugsource-1:4.4.2-10.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • wireshark-debugsource-1:4.4.2-10.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +9 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Avoid analyzing capture files or live traffic from untrusted sources. If ANSI C12.22 parsing is not required, disable the dissector by unchecking C1222 under Analyze > Enabled Protocols in Wireshark, or by executing tshark with the -d c1222,0 flag. Workaround: To mitigate this issue, avoid opening untrusted capture files or analyzing untrusted live network traffic with Wireshark. Users should only process network data from trusted sources to prevent potential denial of service attacks. Workaround: Do not populate the C12.22 decryption table, and disable the c1222.decrypt preference if crypto verification is not required. Avoid opening untrusted capture files or capturing C12.22 (TCP/1153) traffic from untrusted networks. If the C12.22 dissector is unused, disable it in protocol preferences. Workaround: To mitigate this issue prior to patching, disable the ESS protocol dissector by running tshark --disable-protocol ess or unchecking ESS under Analyze > Enabled Protocols. Additionally, avoid opening packet capture files from untrusted sources and restrict live capture to trusted networks using host firewalls. On systems where packet analysis is non-essential, remove the wireshark package entirely or restrict execution permissions strictly to authorized administrators. Workaround: To mitigate this issue, disable the H.245 protocol dissector by running tshark --disable-protocol h245 or unchecking H.245 under Analyze > Enabled Protocols. Additionally, avoid opening packet capture files from untrusted sources and restrict live capture to trusted networks using host firewalls. On systems where packet analysis is non-essential, remove the wireshark package entirely or restrict execution permissions strictly to authorized administrators. Workaround: Avoid opening untrusted capture files or monitoring untrusted networks where malformed packets may be broadcast. If X.509IF protocol analysis is not required, disable the dissector. In Wireshark, navigate to Analyze > Enabled Protocols and uncheck X.509IF, or run tshark using the flag -d x509if,0 to bypass this dissector entirely. Workaround: Disable the SPDY protocol dissector in Wireshark or TShark to prevent processing of the vulnerable protocol format. For TShark command-line usage, pass the protocol disable flag: ``` tshark --disable-protocol spdy -r <capture_file> ``` For persistent configuration across sessions, append the protocol to the disabled protocols file: ``` echo "spdy" >> ~/.config/wireshark/disabled_protos ``` In the Wireshark graphical interface: 1. Navigate to Analyze -> Enabled Protocols... 2. Search for "SPDY" and clear the checkbox. 3. Click OK or Save. Caveat: Disabling the dissector prevents the decoding and inspection of SPDY protocol streams, treating them as generic TCP or TLS payload. Wireshark must be restarted if it is currently running for configuration changes to take effect. Always ensure capture analysis is conducted with non-privileged user privileges. Workaround: If the SCTP protocol dissector is not being used, it can be disabled via the "Enabled Protocols" dialog box in the Wireshark GUI application. This will also disable the protocol dissector when using "tshark", the command line tool. See the links below for instructions to disable a protocol in Wireshark, specifically the "Control Protocol Dissection" section and the "disabled_protos" configuration file option. https://www.wireshark.org/docs/wsug_html_chunked/ChCustProtocolDissectionSection.html https://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html

🔗 References (11)