CVE-2026-95387

Отчет

Red Hat rates this vulnerability as Important rather than Moderate because heap-based memory corruption could permit arbitrary code execution in the context of the user analyzing traffic, rather than being strictly confined to application termination. On Red Hat Enterprise Linux, Wireshark and its associated utilities are not deployed as unattended system daemons by default. Exploitation therefore requires an analyst to actively process an untrusted packet capture file or monitor live traffic on a hostile network segment.

Меры по смягчению последствий

Disable the SPDY protocol dissector in Wireshark or TShark to prevent processing of the vulnerable protocol format. For TShark command-line usage, pass the protocol disable flag:

For persistent configuration across sessions, append the protocol to the disabled protocols file:

In the Wireshark graphical interface:

1. Navigate to Analyze -> Enabled Protocols...
2. Search for "SPDY" and clear the checkbox.
3. Click OK or Save. Caveat: Disabling the dissector prevents the decoding and inspection of SPDY protocol streams, treating them as generic TCP or TLS payload. Wireshark must be restarted if it is currently running for configuration changes to take effect. Always ensure capture analysis is conducted with non-privileged user privileges.