CVE-2024-4854
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
- Record
CVE-2024-4854- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
EUVDEUVD-2024-44432
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
- Record
EUVD-2024-44432- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6w7h-3cwx-m3mp
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3...
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
- Record
GHSA-6w7h-3cwx-m3mp- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
NVD
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
- Record
CVE-2024-4854- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-4854
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
- Record
ALPINE-CVE-2024-4854- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVAZL-42518
CVE-2024-4854 affecting package wireshark 4.0.8-1
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
- Record
AZL-42518- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVAZL-42564
CVE-2024-4854 affecting package wireshark for versions less than 4.4.7-1
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
- Record
AZL-42564- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
- Record
CVE-2024-4854- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-4854
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
- Record
DEBIAN-CVE-2024-4854- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1725
wireshark security update
Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer.
Security Fix(es):
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file(CVE-2024-4854)
- Record
OESA-2024-1725- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1726
wireshark security update
Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer.
Security Fix(es):
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file(CVE-2024-4854)
- Record
OESA-2024-1726- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1727
wireshark security update
Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer.
Security Fix(es):
Memory handling issue in editcap could cause denial of service via crafted capture file(CVE-2024-4853)
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file(CVE-2024-4854)
Use after free issue in editcap could cause denial of service via crafted capture file(CVE-2024-4855)
- Record
OESA-2024-1727- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1728
wireshark security update
Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer.
Security Fix(es):
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file(CVE-2024-4854)
- Record
OESA-2024-1728- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-4854
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
- Record
UBUNTU-CVE-2024-4854- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2024-0206 No score
Updated wireshark packages fix security vulnerabilities
Memory handling issue in editcap could cause denial of service via crafted capture file. (CVE-2024-4853) MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file. (CVE-2024-4854) Use after free issue in editcap could cause denial of service via crafted capture file. (CVE-2024-4855)
- Record
MGASA-2024-0206- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13978-1 No score
libwireshark17-4.2.5-1.1 on GA media
These are all security issues fixed in the libwireshark17-4.2.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13978-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1865-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
Update to version 3.6.22:
- CVE-2024-4854: MONGO and ZigBee TLV dissector infinite loops (bsc#1224274)
- CVE-2024-4853: The editcap command line utility could crash when chopping bytes from the beginning of a packet (bsc#1224259)
- CVE-2024-4855: The editcap command line utility could crash when injecting secrets while writing multiple files (bsc#1224276)
- Record
SUSE-SU-2024:1865-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2265-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
Update to version 3.6.22:
- CVE-2024-4854: MONGO and ZigBee TLV dissector infinite loops (bsc#1224274)
- CVE-2024-4853: The editcap command line utility could crash when chopping bytes from the beginning of a packet (bsc#1224259)
- CVE-2024-4855: The editcap command line utility could crash when injecting secrets while writing multiple files (bsc#1224276)
- Record
SUSE-SU-2024:2265-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkAlpine:v3.19 |
3.6.0 up to 4.0.15-r0 | 4.0.15-r0 |
wiresharkAlpine:v3.20 |
3.6.0 up to 4.2.5-r0 | 4.2.5-r0 |
wiresharkAlpine:v3.21 |
3.6.0 up to 4.2.5-r0 | 4.2.5-r0 |
wiresharkAlpine:v3.22 |
3.6.0 up to 4.2.5-r0 | 4.2.5-r0 |
wiresharkAlpine:v3.23 |
3.6.0 up to 4.2.5-r0 | 4.2.5-r0 |
wiresharkAlpine:v3.24 |
3.6.0 up to 4.2.5-r0 | 4.2.5-r0 |
wiresharkAzure Linux:2 |
through 4.0.8-1 | None known |
wiresharkAzure Linux:3 |
before 4.4.7-1 | 4.4.7-1 |
wiresharkDebian:12 |
before 4.0.17-0+deb12u1, plus listed versions 4.0.10-14.0.11-14.0.11-1~deb12u14.0.3-14.0.5-1~exp1 Show 5 moreShow less4.0.6-14.0.6-1~deb12u14.0.6-1~exp14.0.7-14.0.8-1 |
4.0.17-0+deb12u1 |
wiresharkDebian:13 |
before 4.2.5-1 | 4.2.5-1 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkDebian:14 |
before 4.2.5-1 | 4.2.5-1 |
wiresharkDebian:11 From an advisory covering 47 CVEs |
before 3.4.16-0+deb11u1, plus listed versions 3.4.10-0+deb11u13.4.4-13.4.6-1~exp13.4.7-13.4.7-1~exp13.4.8-13.4.9-1 |
3.4.16-0+deb11u1 |
wiresharkMageia:9 From an advisory covering 3 CVEs |
before 4.0.15-1.mga9 | 4.0.15-1.mga9 |
wiresharkopenEuler:22.03-LTS-SP1 |
before 3.6.14-8.oe2203sp1 | 3.6.14-8.oe2203sp1 |
wiresharkopenEuler:22.03-LTS-SP3 |
before 3.6.14-8.oe2203sp3 | 3.6.14-8.oe2203sp3 |
wiresharkopenEuler:24.03-LTS From an advisory covering 3 CVEs |
before 3.6.14-9.oe2403 | 3.6.14-9.oe2403 |
wiresharkopenEuler:20.03-LTS-SP4 |
before 3.6.14-8.oe2003sp4 | 3.6.14-8.oe2003sp4 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP5 From an advisory covering 3 CVEs |
before 3.6.23-150000.3.115.1 | 3.6.23-150000.3.115.1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 3 CVEs |
before 3.6.23-150000.3.115.1 | 3.6.23-150000.3.115.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 From an advisory covering 3 CVEs |
before 3.6.23-150000.3.115.1 | 3.6.23-150000.3.115.1 |
wiresharkopenSUSE:Leap 15.5 From an advisory covering 3 CVEs |
before 3.6.23-150000.3.115.1 | 3.6.23-150000.3.115.1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 3 CVEs |
before 3.6.23-150600.18.3.1 | 3.6.23-150600.18.3.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP6 From an advisory covering 3 CVEs |
before 3.6.23-150600.18.3.1 | 3.6.23-150600.18.3.1 |
wiresharkopenSUSE:Leap 15.6 From an advisory covering 3 CVEs |
before 3.6.23-150600.18.3.1 | 3.6.23-150600.18.3.1 |
wiresharkUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-1 Show 9 moreShow less1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.12.6.3-1~ubuntu14.04.12.6.4-2~ubuntu14.04.12.6.5-1~ubuntu14.04.12.6.6-1~ubuntu14.04.02.6.8-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm22.6.10-1~ubuntu14.04.0~esm3 |
None known |
wiresharkUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 8 moreShow less2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.02.6.8-1~ubuntu16.04.02.6.10-1~ubuntu16.04.02.6.10-1~ubuntu16.04.0+esm12.6.10-1~ubuntu16.04.0+esm2 |
None known |
wiresharkUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.1 Show 7 moreShow less2.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.02.6.8-1~ubuntu18.04.02.6.10-1~ubuntu18.04.02.6.10-1~ubuntu18.04.0+esm12.6.10-1~ubuntu18.04.0+esm2 |
None known |
wiresharkUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.0.5-13.0.7-13.2.1-13.2.2-13.2.3-13.2.3-1ubuntu0.1~esm13.2.3-1ubuntu0.1~esm2 |
None known |
wiresharkUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.4.7-1~exp13.4.9-13.6.2-1ubuntu13.6.2-23.6.2-2ubuntu0.1~esm1 |
None known |
wiresharkUbuntu:24.04:LTS |
All versions, plus listed versions 4.0.8-14.0.10-14.0.11-14.2.0-14.2.2-14.2.2-1.1build14.2.2-1.1build24.2.2-1.1build3 |
None known |
wiresharkopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 4.2.5-1.1 | 4.2.5-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-4854 is a medium vulnerability (CVSS 6.4) in Wireshark, published May 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.81%, the 57th percentile. Fixed in wireshark 4.0.15-r0.
References
wireshark.org/security/wnpa-sec-2024-07.html
gitlab.com/wireshark/wireshark/-/issues/19726
lists.fedoraproject.org/archives/list/[email protected]/message/66H2BSENPSIALF2WIZF7M3QBVWYBMFGW
Show 24 moreShow less
lists.debian.org/debian-lts-announce/2024/09/msg00049.html
nvd.nist.gov/vuln/detail/CVE-2024-4854
github.com/advisories/GHSA-6w7h-3cwx-m3mp
security.alpinelinux.org/vuln/CVE-2024-4854
security-tracker.debian.org/tracker/CVE-2024-4854
advisories.mageia.org/MGASA-2024-0206.html
bugs.mageia.org/show_bug.cgi?id=33258
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1725
suse.com/support/update/announcement/2024/suse-su-20241865-1
bugzilla.suse.com/1224259
ubuntu.com/security/CVE-2024-4854
cve.org/CVERecord?id=CVE-2024-4854