UDS protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

An update of the wireshark package has been released.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6249 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6249-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 06, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : wireshark     CVE ID         : CVE-2026-5299 CVE-2026-5401 CVE-2026-5403 CVE-2026-5404                      CVE-2026-5405 CVE-2026-5406 CVE-2026-5407 CVE-2026-5408                      CVE-2026-5409 CVE-2026-5653 CVE-2026-5654 CVE-2026-5656                      CVE-2026-5657 CVE-2026-6519 CVE-2026-6520 CVE-2026-6521                      CVE-2026-6522 CVE-2026-6523 CVE-2026-6524 CVE-2026-6527                      CVE-2026-6529 CVE-2026-6530 CVE-2026-6531 CVE-2026-6532                      CVE-2026-6533 CVE-2026-6534 CVE-2026-6535 CVE-2026-6537                      CVE-2026-6538 CVE-2026-6867 CVE-2026-6868 CVE-2026-6869                      CVE-2026-6870 CVE-2026-7375 CVE-2026-7376 CVE-2026-7378                      CVE-2026-7379

    Multiple vulnerabilities have been discocvered in Wireshark, a network     protocol analyzer which could result in denial of service or the     execution of arbitrary code.

    For the oldstable distribution (bookworm), a subset of these problems     have been fixed in version 4.0.17-0+deb12u3.

    For the stable distribution (trixie), these problems have been fixed in     version 4.4.15-0+deb13u1.

    We recommend that you upgrade your wireshark packages.

    For the detailed security status of wireshark please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/wireshark

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - UDS protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of     service (CVE-2026-7375)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321831	Photon OS 4.0: Wireshark PHSA-2026-4.0-1036	Nessus	PhotonOS Local Security Checks	high
318608	Photon OS 5.0: Wireshark PHSA-2026-5.0-0862	Nessus	PhotonOS Local Security Checks	high
313009	Debian dsa-6249 : libwireshark-data - security update	Nessus	Debian Local Security Checks	high
311240	Linux Distros Unpatched Vulnerability : CVE-2026-7375	Nessus	Misc.	high

Detections

Analytics

CVE-2026-7375

high

Tenable Plugins

high

high

high

high