CVE-2022-0581

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Wireshark Foundation	Wireshark	>=3.6.0, <3.6.2; >=3.4.0, <3.4.12

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0581.jsonThird Party Advisory
https://gitlab.com/wireshark/wireshark/-/issues/17935Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00041.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRJ24JRKLA6XMDKLGVTOPM5KBBU4UHLN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3DZD2JU56ZI4XV2B3HGVGA5PXQDNA5T/
https://security.gentoo.org/glsa/202210-04Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2022-05.htmlIssue Tracking, Vendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0581.jsonThird Party Advisory
https://gitlab.com/wireshark/wireshark/-/issues/17935Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00041.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00049.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRJ24JRKLA6XMDKLGVTOPM5KBBU4UHLN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3DZD2JU56ZI4XV2B3HGVGA5PXQDNA5T/
https://security.gentoo.org/glsa/202210-04Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2022-05.htmlIssue Tracking, Vendor Advisory

Timeline

Published: Feb 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-05829.8Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injecti CVE-2022-05837.5Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafte CVE-2022-05856.5Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or CVE-2022-05867.5Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or c CVE-2022-05876.5Improper Authorization in Packagist librenms/librenms prior to 22.2.0.CVE-2022-05886.5Missing Authorization in Packagist librenms/librenms prior to 22.2.0.CVE-2022-05895.4Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.CVE-2022-05904.8The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege use CVE-2022-05919.1The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues e CVE-2022-05929.8The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, l CVE-2022-05936.5The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks CVE-2022-05945.3The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one