CVE-2022-4344

MEDIUM

Wireshark 3.6.0-3.6.9 and 4.0.0-4.0.1 - Denial of Service via Kafka Protocol Dissector Memory Exhaustion

Title source: llm

Description

Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file

References (5)

Core 5

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2024/09/msg00049.html

Third Party Advisory

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4344.json

View Writeup ZIP pw:eip

Vendor Advisory

https://www.wireshark.org/security/wnpa-sec-2022-10.html

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDZMWIKH3L5JQZC6GSVOJ3N5UXNQPJGQ/

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGWIW6K64PKC375YAONYXKIVT2FDEDV3/

Scores

CVSS v3 6.3

EPSS 0.0057

EPSS Percentile 42.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-400

Status published

Products (1)

wireshark/wireshark 3.0.0 - 3.6.10

Published Jan 12, 2023

Tracked Since Feb 18, 2026