CVE-2024-4854

Published: May 14, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file

Affected (5)

Products: Fedoraproject: Fedora · Wireshark: Wireshark

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 39
Fedoraproject Fedora	Version 40

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Wireshark Wireshark	From 3.6.0 to 3.6.22
Wireshark Wireshark	From 4.0.0 to 4.0.14
Wireshark Wireshark	From 4.2.0 to 4.2.4

Related CWEs

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (11)

https://gitlab.com/wireshark/wireshark/-/issues/19726

Source: cve@gitlab.com

Issue Tracking

https://gitlab.com/wireshark/wireshark/-/merge_requests/15047

Source: cve@gitlab.com

Product

https://gitlab.com/wireshark/wireshark/-/merge_requests/15499

Source: cve@gitlab.com

Product

https://www.wireshark.org/security/wnpa-sec-2024-07.html

Source: cve@gitlab.com

Vendor Advisory

https://gitlab.com/wireshark/wireshark/-/issues/19726