CVE-2021-4182

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
Wireshark Foundation	Wireshark	=3.6.0; >=3.4.0, <3.4.10

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4182.jsonThird Party Advisory
https://gitlab.com/wireshark/wireshark/-/issues/17801Exploit, Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6XGBKWSQFCVYUN4ZK3O3NJIFP3OAFVT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5AEK3XTOIOGCGUILUFISMGX54YJXWGJ/
https://security.gentoo.org/glsa/202210-04Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2021-20.htmlVendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4182.jsonThird Party Advisory
https://gitlab.com/wireshark/wireshark/-/issues/17801Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00049.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6XGBKWSQFCVYUN4ZK3O3NJIFP3OAFVT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5AEK3XTOIOGCGUILUFISMGX54YJXWGJ/
https://security.gentoo.org/glsa/202210-04Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2021-20.htmlVendor Advisory

Timeline

Published: Dec 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-418216.5Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial of service. A crafted CVE-2021-418236.1The Web Application Firewall (WAF) in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism.CVE-2021-418248.8Craft CMS before 3.7.14 allows CSV injection.CVE-2021-418255.3Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter.CVE-2021-418266.1PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect.CVE-2021-418277.5Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source co CVE-2021-418287.5Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml.CVE-2021-418297.5Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key.CVE-2021-41835.5Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file CVE-2021-418307.5It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache Ope CVE-2021-418315.3It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected.CVE-2021-418327.5It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4