Every CVE Search/ Get API key

CVE-2024-24478

An issue in Wireshark team Wireshark before v.4.2.0 allows a remote attacker to cause a denial of...

7.5 HighFix availableDisputed

An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_ttvb, proto_treetree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.98%Up 0.9 points since Feb 22, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_ttvb, proto_treetree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.

Record
CVE-2024-24478
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-680
Updated
2026-11-02
EUVDEUVD-2024-21897 7.5

An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_ttvb, proto_treetree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.

Record
EUVD-2024-21897
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-q2p3-j458-f7vv 7.5

An issue in Wireshark team Wireshark before v.4.2.0 allows a remote attacker to cause a denial of...

An issue in Wireshark team Wireshark before v.4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_ttvb, proto_treetree, packet_info*pinfo), optlen components.

Record
GHSA-q2p3-j458-f7vv
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-680
Updated
2026-11-02
NVD 7.5

An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_ttvb, proto_treetree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.

Record
CVE-2024-24478
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-680
Updated
2026-11-02
OSV 7.5

An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_ttvb, proto_treetree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.

Record
CVE-2024-24478
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-43822 No score

CVE-2024-24478 affecting package wireshark 4.0.8-1

An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_ttvb, proto_treetree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.

Record
AZL-43822
Updated
2026-11-02
OSVAZL-44853 No score

CVE-2024-24478 affecting package wireshark for versions less than 4.4.7-1

An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_ttvb, proto_treetree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.

Record
AZL-44853
Updated
2026-11-02
OSVCLSA-2026-1775032927 No score

wireshark: Fix of 11 CVEs

  • CVE-2023-6175: fix heap buffer overflow in NetScreen file parser
  • CVE-2024-0208: fix crash in GVCP dissector due to NULL string
  • CVE-2024-0209: fix uncontrolled recursion in ASN.1 dissectors
  • CVE-2024-0211: fix infinite loop in DOCSIS dissector
  • CVE-2024-2955: fix use-after-free in T.38 dissector
  • CVE-2024-8250: fix stack buffer overflow in NTLMSSP dissector
  • CVE-2024-9781: fix crash in AppleTalk and RELOAD Framing dissectors
  • CVE-2024-11596: fix buffer overflow in ECMP dissector
  • CVE-2024-24476: fix heap buffer overflow in address resolution
  • CVE-2024-24478: fix integer overflow in BGP dissector
  • CVE-2025-5601: fix crash in column prepend fence handling
Record
CLSA-2026-1775032927
Updated
2026-11-02
OSVCLSA-2026-1775039763 No score

wireshark: Fix of 11 CVEs

  • CVE-2023-6175: fix heap buffer overflow in NetScreen file parser
  • CVE-2024-0208: fix crash in GVCP dissector due to NULL string
  • CVE-2024-0209: fix uncontrolled recursion in ASN.1 dissectors
  • CVE-2024-0211: fix infinite loop in DOCSIS dissector
  • CVE-2024-2955: fix use-after-free in T.38 dissector
  • CVE-2024-8250: fix stack buffer overflow in NTLMSSP dissector
  • CVE-2024-9781: fix crash in AppleTalk and RELOAD Framing dissectors
  • CVE-2024-11596: fix buffer overflow in ECMP dissector
  • CVE-2024-24476: fix heap buffer overflow in address resolution
  • CVE-2024-24478: fix integer overflow in BGP dissector
  • CVE-2025-5601: fix crash in column prepend fence handling
Record
CLSA-2026-1775039763
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wireshark
Azure Linux:2
 through 4.0.8-1 None known
wireshark
Azure Linux:3
 before 4.4.7-1
4.4.7-1
wireshark
TuxCare:AlmaLinux:9.6
From an advisory covering 11 CVEs
 before 1:3.4.10-7.el9_6.tuxcare.els2
1:3.4.10-7.el9_6.tuxcare.els2
wireshark-cli
TuxCare:AlmaLinux:9.6
From an advisory covering 11 CVEs
 before 1:3.4.10-7.el9_6.tuxcare.els2
1:3.4.10-7.el9_6.tuxcare.els2
wireshark-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 11 CVEs
 before 1:3.4.10-7.el9_6.tuxcare.els2
1:3.4.10-7.el9_6.tuxcare.els2
wireshark
TuxCare:AlmaLinux:9.2
From an advisory covering 11 CVEs
 before 1:3.4.10-4.el9.tuxcare.els3
1:3.4.10-4.el9.tuxcare.els3
wireshark-cli
TuxCare:AlmaLinux:9.2
From an advisory covering 11 CVEs
 before 1:3.4.10-4.el9.tuxcare.els3
1:3.4.10-4.el9.tuxcare.els3
wireshark-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 11 CVEs
 before 1:3.4.10-4.el9.tuxcare.els3
1:3.4.10-4.el9.tuxcare.els3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-24478 is a high vulnerability (CVSS 7.5) in Wireshark, published February 21, 2024. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in wireshark 4.4.7-1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open