Infinite loop in SharkFest Foundation Wireshark
Priority LOW 32CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-835.
Summary
Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows denial of service via packet injection or crafted capture file
Why it matters now
EPSS 0.02296 83rd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Wireshark (SharkFest Foundation): 3.6.8, 3.4.16Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SharkFest Foundation | Wireshark | 3.6.0 to before 3.6.8; 3.4.0 to before 3.4.16 | 3.6.8, 3.4.16 | Patch available | CNA |
- Wireshark VendorSharkFest Foundation Affected 3.6.0 to before 3.6.8; 3.4.0 to before 3.4.16 Fixed in 3.6.8, 3.4.16 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:* | 3.4.0 to before 3.4.16; 3.6.0 to before 3.6.8 | Vulnerable | Wireshark Foundation |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:* Versions 3.4.0 to before 3.4.16; 3.6.0 to before 3.6.8 Vulnerable ·Wireshark Foundation
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA Wireshark (SharkFest Foundation) Fixed in 3.6.8, 3.4.16
Red Hat 1 advisory
- RHSA-2023:2373 Released 2023-05-09 · Red Hat rating Moderatewireshark security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) wireshark-1:3.4.10-4.el9, wireshark-cli-1:3.4.10-4.el9
- Red Hat Enterprise Linux CRB (v. 9) wireshark-devel-1:3.4.10-4.el9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:2373 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2023:2373 |
Not affected: 3 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3190
- 2026-10-03 Alias added: GHSA-h8c6-fw25-mvvx
References
Sources
- CVE-2022-3190 · CVE Program
- CVE-2022-3190 · NVD
- FIRST EPSS
- GHSA-h8c6-fw25-mvvx · GitHub Advisory Database · CC BY 4.0
- CVE-2022-3190 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences