CVE-2022-0585

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or crafted capture file

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-834

Affected software

Vendor	Product	Versions
Wireshark Foundation	Wireshark	>=3.6.0, <3.6.2; >=3.4.0, <3.4.12

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0585.jsonThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00041.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRJ24JRKLA6XMDKLGVTOPM5KBBU4UHLN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3DZD2JU56ZI4XV2B3HGVGA5PXQDNA5T/
https://security.gentoo.org/glsa/202210-04Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2022-02.htmlExploit, Vendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0585.jsonThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00041.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00049.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRJ24JRKLA6XMDKLGVTOPM5KBBU4UHLN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3DZD2JU56ZI4XV2B3HGVGA5PXQDNA5T/
https://security.gentoo.org/glsa/202210-04Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2022-02.htmlExploit, Vendor Advisory

Timeline

Published: Feb 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-05867.5Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or c CVE-2022-05876.5Improper Authorization in Packagist librenms/librenms prior to 22.2.0.CVE-2022-05886.5Missing Authorization in Packagist librenms/librenms prior to 22.2.0.CVE-2022-05895.4Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.CVE-2022-05904.8The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege use CVE-2022-05919.1The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues e CVE-2022-05929.8The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, l CVE-2022-05936.5The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks CVE-2022-05945.3The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one CVE-2022-05955.4The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_uplo CVE-2022-05964.3Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05976.1Open Redirect in Packagist microweber/microweber prior to 1.2.11.