// For flags

CVE-2020-26418

Gentoo Linux Security Advisory 202101-12

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.

Una filtración de memoria en el disector de protocolo Kafka en Wireshark versión 3.4.0 y versiones 3.2.0 hasta 3.2.8, permite una Denegación de Servicio por medio de una inyección de paquetes o archivo de captura diseñado

An update that solves 9 vulnerabilities and has two fixes is now available. This update for wireshark, libvirt, sbc and libqt5-qtmultimedia fixes the following issues. Update wireshark to version 3.4.5 Including security fixes for. Wireshark could open unsafe URLs. MS-WSP dissector excessive memory consumption QUIC dissector crash Kafka dissector memory leak Multiple dissector memory leaks RTPS dissector memory leak USB HID dissector crash. Fixed USB HID dissector memory leak. Fixed USB HID dissector crash libqt5-qtmultimedia and sbc are necessary dependencies. Libvirt is needed to rebuild wireshark-plugin-libvirt.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-10-01 CVE Reserved
  • 2020-12-10 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • 2025-07-13 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-401: Missing Release of Memory after Effective Lifetime
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Wireshark
Search vendor "Wireshark"
 Wireshark
Search vendor "Wireshark" for product "Wireshark"
 >= 3.2.0 <= 3.2.8
Search vendor "Wireshark" for product "Wireshark" and version " >= 3.2.0 <= 3.2.8"
-
Affected
Wireshark
Search vendor "Wireshark"
 Wireshark
Search vendor "Wireshark" for product "Wireshark"
 3.4.0
Search vendor "Wireshark" for product "Wireshark" and version "3.4.0"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
 Fedora
Search vendor "Fedoraproject" for product "Fedora"
 32
Search vendor "Fedoraproject" for product "Fedora" and version "32"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
 Fedora
Search vendor "Fedoraproject" for product "Fedora"
 33
Search vendor "Fedoraproject" for product "Fedora" and version "33"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 9.0
Search vendor "Debian" for product "Debian Linux" and version "9.0"
-
Affected
Oracle
Search vendor "Oracle"
 Zfs Storage Appliance Kit
Search vendor "Oracle" for product "Zfs Storage Appliance Kit"
 8.8
Search vendor "Oracle" for product "Zfs Storage Appliance Kit" and version "8.8"
-
Affected