CVE-2026-5401 Details
Description
AFP Spotlight protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
A denial-of-service vulnerability has been identified in the Wireshark AFP Spotlight protocol dissector, specifically in versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The issue arises from a stack overflow in the 'spotlight_dissect_query_loop()' function, which processes Spotlight query entries. The recursion is driven by packet data, leading to unbounded recursion and a crash (SIGSEGV) on systems with 8MB or 1MB stack limits. This vulnerability can be exploited by injecting malformed packets or by using a crafted pcap file that triggers the recursive dissection without the '-V' flag, which is the default behavior for pcap processing.
Users can upgrade to Wireshark versions 4.6.5, 4.4.15 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/wireshark/wireshark/-/issues/21088 | CISA-ADP | ExploitIssue Tracking |
| https://gitlab.com/wireshark/wireshark/-/issues/21088 | [email protected] | ExploitIssue Tracking |
| https://www.wireshark.org/security/wnpa-sec-2026-13.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wireshark wireshark | >= 4.4.0, <= 4.4.14 >= 4.6.0, <= 4.6.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 30, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | New CVE Received | [email protected] |