CVE-2025-13499 Details
Description
Kafka dissector crash in Wireshark 4.6.0 and 4.4.0 to 4.4.10 allows denial of service
A denial-of-service vulnerability has been identified in the Wireshark Kafka dissector, specifically in versions 4.6.0 and 4.4.0 through 4.4.10. The issue arises when the Kafka dissector processes packets, leading to a crash. This vulnerability can be triggered by injecting a malformed packet or by reading a packet trace file that contains such a packet.
Users can upgrade to Wireshark versions 4.6.1 or 4.4.11 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 22, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/wireshark/wireshark/-/issues/20823 | [email protected] | Issue TrackingVendor Advisory |
| https://www.wireshark.org/security/wnpa-sec-2025-06.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-824 | Access of Uninitialized Pointer | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wireshark wireshark | >= 4.4.0, < 4.4.11 4.6.0 - |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 31, 2025 | Modified Analysis | [email protected] |
| Dec 3, 2025 | Initial Analysis | [email protected] |
| Nov 21, 2025 | New CVE Received | [email protected] |