CVE-2026-0960

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

HTTP3 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.2 allows denial of service

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

VendorProductVersions
Wireshark FoundationWireshark>= 4.6.0, < 4.6.3

References

Timeline

Published
Jan 14, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-09616.5BLF file parser crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of serviceCVE-2026-09626.5SOME/IP-SD protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of serviceCVE-2026-09638.8An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attaCVE-2026-09646.3A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. TCVE-2026-09653.3A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by pCVE-2026-09668.2A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This cCVE-2026-09675.5A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnameCVE-2026-09683.1A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' CVE-2026-09698.8The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of CVE-2026-09714.3An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected tCVE-2026-09725.4HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and descriptioCVE-2026-09748.8The Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin plugin for WordPress is vulnerable to unauthorized plug
CVE-2026-0960: Medium severity, CVSS 5.5 | Vulnix