CVE-2020-26422

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
The Wireshark Foundation	Wireshark	>=3.4.0, <3.4.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26422.jsonThird Party Advisory
https://gitlab.com/wireshark/wireshark/-/issues/17073Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202101-12Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2020-20.htmlVendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26422.jsonThird Party Advisory
https://gitlab.com/wireshark/wireshark/-/issues/17073Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202101-12Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2020-20.htmlVendor Advisory

Timeline

Published: Dec 21, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-26436.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Job System). Supported versions that CVE-2020-26446.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Oracle Management Service). Supported CVE-2020-26456.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Supported versi CVE-2020-26465.4Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Command Line Interface). Supported ve CVE-2020-26475.0Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). Supported versions that are affected are 10 and 11. Easil CVE-2020-26486.2Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Interna CVE-2020-26493.3Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Interna CVE-2020-26506.5Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Promoti CVE-2020-265056.1A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code CVE-2020-265064.3An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain contr CVE-2020-265077.8A CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users CVE-2020-265089.8The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials via the export featur