CVE-2020-28030
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan...
7.5 HighFix available
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
2.07%Up 0.6 points since Apr 14, 2021
What each source reports
NVD Score used
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.
- Record
CVE-2020-28030- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-682, CWE-770, CWE-835
- Updated
- 2026-11-02
CVE List No score
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.
- Record
CVE-2020-28030- Updated
- 2026-11-02
EUVDEUVD-2020-20521 No score
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.
- Record
EUVD-2020-20521- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-983p-wv66-ffx7 No score
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan...
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.
- Record
GHSA-983p-wv66-ffx7- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-28030
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.
- Record
ALPINE-CVE-2020-28030- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.
- Record
CVE-2020-28030- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2020-28030
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.
- Record
DEBIAN-CVE-2020-28030- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-28030
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.
- Record
UBUNTU-CVE-2020-28030- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:2076-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
- wireshark was updated to 3.2.8:
- CVE-2020-26575: Fixed an issue where FBZERO dissector was entering in infinite loop (bsc#1177406)
- CVE-2020-28030: Fixed an issue where GQUIC dissector was crashing (bsc#1178291)
- Infinite memory allocation while parsing this tcp packet
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:2076-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:2107-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
- wireshark was updated to 3.2.8:
- CVE-2020-26575: Fixed an issue where FBZERO dissector was entering in infinite loop (bsc#1177406)
- CVE-2020-28030: Fixed an issue where GQUIC dissector was crashing (bsc#1178291)
- Infinite memory allocation while parsing this tcp packet
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:2107-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11513-1 No score
libwireshark14-3.4.8-1.2 on GA media
These are all security issues fixed in the libwireshark14-3.4.8-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11513-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3376-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
- wireshark was updated to 3.2.8:
- CVE-2020-26575: Fixed an issue where FBZERO dissector was entering in infinite loop (bsc#1177406)
- CVE-2020-28030: Fixed an issue where GQUIC dissector was crashing (bsc#1178291)
- Infinite memory allocation while parsing this tcp packet
- Record
SUSE-SU-2020:3376-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkAlpine:v3.12 |
3.2.0 up to 3.2.8-r0 | 3.2.8-r0 |
wiresharkAlpine:v3.13 |
3.2.0 up to 3.4.0-r0 | 3.4.0-r0 |
wiresharkAlpine:v3.14 |
3.2.0 up to 3.4.0-r0 | 3.4.0-r0 |
wiresharkAlpine:v3.15 |
3.2.0 up to 3.4.0-r0 | 3.4.0-r0 |
wiresharkAlpine:v3.16 |
3.2.0 up to 3.4.0-r0 | 3.4.0-r0 |
wiresharkAlpine:v3.17 |
3.2.0 up to 3.4.0-r0 | 3.4.0-r0 |
wiresharkAlpine:v3.18 |
3.2.0 up to 3.4.0-r0 | 3.4.0-r0 |
wiresharkAlpine:v3.19 |
3.2.0 up to 3.4.0-r0 | 3.4.0-r0 |
wiresharkAlpine:v3.20 |
3.2.0 up to 3.4.0-r0 | 3.4.0-r0 |
wiresharkAlpine:v3.21 |
3.2.0 up to 3.4.0-r0 | 3.4.0-r0 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkAlpine:v3.22 |
3.2.0 up to 3.4.0-r0 | 3.4.0-r0 |
wiresharkAlpine:v3.23 |
3.2.0 up to 3.4.0-r0 | 3.4.0-r0 |
wiresharkAlpine:v3.24 |
3.2.0 up to 3.4.0-r0 | 3.4.0-r0 |
wiresharkDebian:12 |
before 3.2.8-0.1 | 3.2.8-0.1 |
wiresharkDebian:13 |
before 3.2.8-0.1 | 3.2.8-0.1 |
wiresharkDebian:14 |
before 3.2.8-0.1 | 3.2.8-0.1 |
wiresharkDebian:9 From an advisory covering 17 CVEs |
before 2.6.20-0+deb9u1, plus listed versions 2.2.6+g32dac6a-22.2.6+g32dac6a-2+deb9u12.2.6+g32dac6a-2+deb9u22.2.6+g32dac6a-2+deb9u32.2.7-1 Show 24 moreShow less2.4.0-12.4.1-12.4.2-12.4.3-12.4.4-12.4.5-12.4.6-12.6.1-12.6.10-12.6.2-12.6.2-22.6.3-12.6.3-1~deb9u12.6.4-12.6.4-22.6.5-12.6.5-1~deb9u12.6.6-12.6.7-12.6.7-1~deb9u12.6.8-12.6.8-1.12.6.8-1.1~deb9u12.6.9-1 |
2.6.20-0+deb9u1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 2 CVEs |
before 3.2.8-3.44.1 | 3.2.8-3.44.1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP2 From an advisory covering 2 CVEs |
before 3.2.8-3.44.1 | 3.2.8-3.44.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 2 CVEs |
before 3.2.8-3.44.1 | 3.2.8-3.44.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP2 From an advisory covering 2 CVEs |
before 3.2.8-3.44.1 | 3.2.8-3.44.1 |
wiresharkUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-1 Show 9 moreShow less1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.12.6.3-1~ubuntu14.04.12.6.4-2~ubuntu14.04.12.6.5-1~ubuntu14.04.12.6.6-1~ubuntu14.04.02.6.8-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm22.6.10-1~ubuntu14.04.0~esm3 |
None known |
wiresharkUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 8 moreShow less2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.02.6.8-1~ubuntu16.04.02.6.10-1~ubuntu16.04.02.6.10-1~ubuntu16.04.0+esm12.6.10-1~ubuntu16.04.0+esm2 |
None known |
wiresharkUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.1 Show 7 moreShow less2.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.02.6.8-1~ubuntu18.04.02.6.10-1~ubuntu18.04.02.6.10-1~ubuntu18.04.0+esm12.6.10-1~ubuntu18.04.0+esm2 |
None known |
wiresharkUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.0.5-13.0.7-13.2.1-13.2.2-13.2.3-13.2.3-1ubuntu0.1~esm13.2.3-1ubuntu0.1~esm2 |
None known |
wiresharkopenSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 3.2.8-lp152.2.9.1 | 3.2.8-lp152.2.9.1 |
wiresharkopenSUSE:Leap 15.1 From an advisory covering 2 CVEs |
before 3.2.8-lp151.2.18.1 | 3.2.8-lp151.2.18.1 |
wiresharkopenSUSE:Tumbleweed From an advisory covering 163 CVEs |
before 3.4.8-1.2 | 3.4.8-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-28030 is a high vulnerability (CVSS 7.5) in Wireshark, published October 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. Fixed in wireshark 3.2.8-r0.
References
gitlab.com/wireshark/wireshark/-/issues/16887
wireshark.org/security/wnpa-sec-2020-15.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHZSVK7PO2LTGFQXFHFXY6SOMSQ7UPRS
lists.debian.org/debian-lts-announce/2021/02/msg00008.html
Show 176 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-28030
github.com/advisories/GHSA-983p-wv66-ffx7
security.alpinelinux.org/vuln/CVE-2020-28030
security-tracker.debian.org/tracker/CVE-2020-28030
suse.com/support/update/announcement/2020/suse-su-20203376-1
bugzilla.suse.com/1177406
ubuntu.com/security/CVE-2020-28030
cve.org/CVERecord?id=CVE-2020-28030
lists.opensuse.org/archives/list/[email protected]/thread/5P4NEYKGIIBUWVHMTUJCIGGFEUIWBFC7