CVE-2021-4181
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of...
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
- Record
CVE-2021-4181- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
EUVDEUVD-2021-34041
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
- Record
EUVD-2021-34041- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jr2g-cv62-4vcw
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of...
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
- Record
GHSA-jr2g-cv62-4vcw- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-74, CWE-125
- Updated
- 2026-11-02
NVD
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
- Record
CVE-2021-4181- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-4181
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
- Record
ALPINE-CVE-2021-4181- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVAZL-7417
CVE-2021-4181 affecting package wireshark for versions less than 3.4.14-1
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
- Record
AZL-7417- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSV
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
- Record
CVE-2021-4181- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-4181
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
- Record
DEBIAN-CVE-2021-4181- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2022-1610
wireshark security update
Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols.
Security Fix(es):
Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injection or crafted capture file(CVE-2021-22207)
Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file.(CVE-2021-22191)
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file(CVE-2021-4181)
Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file(CVE-2021-4185)
- Record
OESA-2022-1610- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-4181
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
- Record
UBUNTU-CVE-2021-4181- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1777370059 No score
wireshark: Fix of 7 CVEs
- CVE-2021-4181: sysdig event dissector SIGSEGV fix
- CVE-2021-4182: rfc7468 file parser infinite loop fix
- CVE-2021-4184: bt-dht endless loop fix
- CVE-2021-4186: gryphon NULL pkt_info dereference fix
- CVE-2021-4190: kafka dissector varint strictness fix
- CVE-2022-0581: cms dissector globals-scoping fix
- CVE-2022-0583: pvfs2 heap overflow OOB read fix
- Record
CLSA-2026-1777370059- Updated
- 2026-11-02
OSVMGASA-2022-0004 No score
Updated wireshark packages fix security vulnerability
Several wireshark vulnerabilities have been fixed. See the release notes for details.
- Record
MGASA-2022-0004- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0375-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
Update to version 3.6.1:
- CVE-2021-4185: RTMPT dissector infinite loop (bsc#1194166)
- CVE-2021-4184: BitTorrent DHT dissector infinite loop (bsc#1194167)
- CVE-2021-4183: pcapng file parser crash (bsc#1194168)
- CVE-2021-4182: RFC 7468 file parser infinite loop (bsc#1194169)
- CVE-2021-4181: Sysdig Event dissector crash (bsc#1194170)
- CVE-2021-4190: Kafka dissector infinite loop (bsc#1194171)
- Support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Record
openSUSE-SU-2022:0375-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11703-1 No score
libwireshark15-3.6.1-1.1 on GA media
These are all security issues fixed in the libwireshark15-3.6.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11703-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0375-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
Update to version 3.6.1:
- CVE-2021-4185: RTMPT dissector infinite loop (bsc#1194166)
- CVE-2021-4184: BitTorrent DHT dissector infinite loop (bsc#1194167)
- CVE-2021-4183: pcapng file parser crash (bsc#1194168)
- CVE-2021-4182: RFC 7468 file parser infinite loop (bsc#1194169)
- CVE-2021-4181: Sysdig Event dissector crash (bsc#1194170)
- CVE-2021-4190: Kafka dissector infinite loop (bsc#1194171)
- Support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Record
SUSE-SU-2022:0375-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkAlpine:v3.15 |
3.4.0 up to 3.4.13-r0 | 3.4.13-r0 |
wiresharkAlpine:v3.16 |
3.4.0 up to 3.4.11-r0 | 3.4.11-r0 |
wiresharkAlpine:v3.17 |
3.4.0 up to 3.4.11-r0 | 3.4.11-r0 |
wiresharkAlpine:v3.18 |
3.4.0 up to 3.4.11-r0 | 3.4.11-r0 |
wiresharkAlpine:v3.19 |
3.4.0 up to 3.4.11-r0 | 3.4.11-r0 |
wiresharkAlpine:v3.20 |
3.4.0 up to 3.4.11-r0 | 3.4.11-r0 |
wiresharkAlpine:v3.21 |
3.4.0 up to 3.4.11-r0 | 3.4.11-r0 |
wiresharkAlpine:v3.22 |
3.4.0 up to 3.4.11-r0 | 3.4.11-r0 |
wiresharkAlpine:v3.23 |
3.4.0 up to 3.4.11-r0 | 3.4.11-r0 |
wiresharkAlpine:v3.24 |
3.4.0 up to 3.4.11-r0 | 3.4.11-r0 |
Show 40 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkAzure Linux:2 |
before 3.4.14-1 | 3.4.14-1 |
wiresharkTuxCare:AlmaLinux:9.2 From an advisory covering 7 CVEs |
before 1:3.4.10-4.el9.tuxcare.els7 | 1:3.4.10-4.el9.tuxcare.els7 |
wireshark-cliTuxCare:AlmaLinux:9.2 From an advisory covering 7 CVEs |
before 1:3.4.10-4.el9.tuxcare.els7 | 1:3.4.10-4.el9.tuxcare.els7 |
wireshark-develTuxCare:AlmaLinux:9.2 From an advisory covering 7 CVEs |
before 1:3.4.10-4.el9.tuxcare.els7 | 1:3.4.10-4.el9.tuxcare.els7 |
wiresharkDebian:12 |
before 3.6.2-1 | 3.6.2-1 |
wiresharkDebian:13 |
before 3.6.2-1 | 3.6.2-1 |
wiresharkDebian:14 |
before 3.6.2-1 | 3.6.2-1 |
wiresharkDebian:9 From an advisory covering 9 CVEs |
before 2.6.20-0+deb9u3, plus listed versions 2.2.6+g32dac6a-22.2.6+g32dac6a-2+deb9u12.2.6+g32dac6a-2+deb9u22.2.6+g32dac6a-2+deb9u32.2.7-1 Show 26 moreShow less2.4.0-12.4.1-12.4.2-12.4.3-12.4.4-12.4.5-12.4.6-12.6.1-12.6.10-12.6.2-12.6.2-22.6.20-0+deb9u12.6.20-0+deb9u22.6.3-12.6.3-1~deb9u12.6.4-12.6.4-22.6.5-12.6.5-1~deb9u12.6.6-12.6.7-12.6.7-1~deb9u12.6.8-12.6.8-1.12.6.8-1.1~deb9u12.6.9-1 |
2.6.20-0+deb9u3 |
wiresharkDebian:11 From an advisory covering 47 CVEs |
before 3.4.16-0+deb11u1, plus listed versions 3.4.10-0+deb11u13.4.4-13.4.6-1~exp13.4.7-13.4.7-1~exp13.4.8-13.4.9-1 |
3.4.16-0+deb11u1 |
wiresharkMageia:8 From an advisory covering 5 CVEs |
before 3.4.11-1.mga8 | 3.4.11-1.mga8 |
wiresharkopenEuler:20.03-LTS-SP1 From an advisory covering 4 CVEs |
before 2.6.2-21.oe1 | 2.6.2-21.oe1 |
wiresharkopenEuler:20.03-LTS-SP2 From an advisory covering 4 CVEs |
before 2.6.2-21.oe1 | 2.6.2-21.oe1 |
wiresharkopenEuler:20.03-LTS-SP3 From an advisory covering 4 CVEs |
before 2.6.2-21.oe1 | 2.6.2-21.oe1 |
libvirtSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 6 CVEs |
before 7.1.0-150300.6.23.1 | 7.1.0-150300.6.23.1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
libvirtSUSE:Linux Enterprise Module for Server Applications 15 SP3 From an advisory covering 6 CVEs |
before 7.1.0-150300.6.23.1 | 7.1.0-150300.6.23.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise Server 15 SP2-BCL From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Manager Proxy 4.1 From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Manager Retail Branch Server 4.1 From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Manager Server 4.1 From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
libvirtSUSE:Linux Enterprise Micro 5.1 From an advisory covering 6 CVEs |
before 7.1.0-150300.6.23.1 | 7.1.0-150300.6.23.1 |
wiresharkSUSE:Enterprise Storage 6 From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkSUSE:Enterprise Storage 7 From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
libvirtopenSUSE:Leap 15.3 From an advisory covering 6 CVEs |
before 7.1.0-150300.6.23.1 | 7.1.0-150300.6.23.1 |
wiresharkopenSUSE:Leap 15.3 From an advisory covering 6 CVEs |
before 3.6.1-3.68.1 | 3.6.1-3.68.1 |
wiresharkopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 3.6.1-1.1 | 3.6.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-4181 is a high vulnerability (CVSS 7.5) in Wireshark, published December 30, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.06%, the 90th percentile. Fixed in wireshark 3.4.13-r0.
References
wireshark.org/security/wnpa-sec-2021-21.html
gitlab.com/wireshark/wireshark/-/merge_requests/5429
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5AEK3XTOIOGCGUILUFISMGX54YJXWGJ
lists.debian.org/debian-lts-announce/2022/03/msg00041.html
Show 40 moreShow less
oracle.com/security-alerts/cpuapr2022.html
security.gentoo.org/glsa/202210-04
nvd.nist.gov/vuln/detail/CVE-2021-4181
github.com/advisories/GHSA-jr2g-cv62-4vcw
security.alpinelinux.org/vuln/CVE-2021-4181
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1777370059.html
security-tracker.debian.org/tracker/CVE-2021-4181
advisories.mageia.org/MGASA-2022-0004.html
bugs.mageia.org/show_bug.cgi?id=29832
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1610
suse.com/support/update/announcement/2022/suse-su-20220375-1
bugzilla.suse.com/1194166
ubuntu.com/security/CVE-2021-4181
cve.org/CVERecord?id=CVE-2021-4181
lists.opensuse.org/archives/list/[email protected]/thread/JAOH336QWFQFZUXO5FOHF4P6VJNY7R4L