CVE-2026-96421
published 2026-09-29CVE-2026-96421: USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
PriorityP416medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.14%
3.1th percentile
USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitlab | wireshark | — | — |
| wireshark | wireshark | — | — |
| wireshark | wireshark | >= 4.4.0 < 4.4.19 | 4.4.19 |
| wireshark | wireshark | >= 4.6.0 < 4.6.9 | 4.6.9 |
| wireshark_foundation | wireshark | >= 4.4.0 < 4.4.19 | 4.4.19 |
| wireshark_foundation | wireshark | >= 4.6.0 < 4.6.9 | 4.6.9 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Wireshark up to 4.4.18/4.6.8 USB HID Protocol Dissector infinite loop (Nessus ID 362908)
vuldb·2026-10-05·CVSS 5.5
CVE-2026-96421 [MEDIUM] Wireshark up to 4.4.18/4.6.8 USB HID Protocol Dissector infinite loop (Nessus ID 362908)
A vulnerability, which was classified as problematic, has been found in Wireshark up to 4.4.18/4.6.8. Affected by this vulnerability is an unknown functionality of the component USB HID Protocol Dissector. Performing a manipulation results in infinite loop.
This vulnerability is cataloged as CVE-2026-96421. The attack must be initiated from a local position. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
ghsa_unreviewed·2026-09-29
CVE-2026-96421 [MEDIUM] CWE-1325 USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Red Hat
wireshark: Wireshark: Denial of Service via USB HID dissector infinite loop
vendor_redhat·2026-09-29·CVSS 5.5
CVE-2026-96421 [MEDIUM] CWE-835 wireshark: Wireshark: Denial of Service via USB HID dissector infinite loop
wireshark: Wireshark: Denial of Service via USB HID dissector infinite loop
A flaw was found in Wireshark. This vulnerability allows an attacker to cause a Denial of Service (DoS) by convincing a user to open a specially crafted packet capture file containing malformed Universal Serial Bus Human Interface Device (USB HID) traffic. When processing the malformed data, the USB HID protocol dissector enters an infinite loop and leaks memory, leading to excessive resource consumption and application unresponsiveness.
Mitigation: Disable the USB HID protocol dissector when USB HID traffic inspection is not required, or avoid processing capture files from untrusted sources.
To disable the protocol dissector in TShark:
```
tshark --disable-protocol usbhid -r capture.pcap
```
To disable the disse
GitLab
Improperly Controlled Sequential Memory Allocation in Wireshark
vendor_gitlab·2026-09-29·CVSS 5.5
CVE-2026-96421 [MEDIUM] CWE-1325 Improperly Controlled Sequential Memory Allocation in Wireshark
Improperly Controlled Sequential Memory Allocation in Wireshark
USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Affected products: Wireshark
Affected versions: >=4.6.0, =4.4.0, <4.4.19 (affected)
Solution: Upgrade to version 4.6.9 or above
Credit: Claude and Ada Logics
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
blogs_hackernews·2026-10-05·CVSS 7.5
CVE-2026-88779 [HIGH] ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook.
There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. Some attacks are getting more capable. Others are still getting in because the basics gave way first.
Here’s what mattered this week.
## ⚡ Threat of the Week
Citrix Warns of Ne
Bugzilla
CVE-2026-96421 wireshark: Wireshark: Denial of Service via USB HID dissector infinite loop [fedora-all]
bugzilla·2026-09-29·CVSS 5.5
CVE-2026-96421 [MEDIUM] CVE-2026-96421 wireshark: Wireshark: Denial of Service via USB HID dissector infinite loop [fedora-all]
CVE-2026-96421 wireshark: Wireshark: Denial of Service via USB HID dissector infinite loop [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Bugzilla
CVE-2026-96421 wireshark: Wireshark: Denial of Service via USB HID dissector infinite loop
bugzilla·2026-09-29·CVSS 5.5
CVE-2026-96421 [MEDIUM] CVE-2026-96421 wireshark: Wireshark: Denial of Service via USB HID dissector infinite loop
CVE-2026-96421 wireshark: Wireshark: Denial of Service via USB HID dissector infinite loop
USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
2026-09-29
Published