Hi,
The following vulnerabilities were published for wireshark.
We should also ship 4.4.19 via trixie-securiy, could someone of
the Wireshark maintainers please prepare an update?`
CVE-2026-95386[0]:
| TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of
| service
https://www.wireshark.org/security/wnpa-sec-2026-94
https://gitlab.com/wireshark/wireshark/-/issues/21501
CVE-2026-95387[1]:
| SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-97
https://gitlab.com/wireshark/wireshark/-/issues/21487
CVE-2026-95388[2]:
| Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows
| denial of service
https://www.wireshark.org/security/wnpa-sec-2026-101
https://gitlab.com/wireshark/wireshark/-/issues/21545
CVE-2026-95389[3]:
| SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-93
https://gitlab.com/wireshark/wireshark/-/issues/21481
CVE-2026-95390[4]:
| PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of
| service
https://www.wireshark.org/security/wnpa-sec-2026-95
https://gitlab.com/wireshark/wireshark/-/issues/21503
CVE-2026-95391[5]:
| ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial
| of service
https://www.wireshark.org/security/wnpa-sec-2026-92
https://gitlab.com/wireshark/wireshark/-/merge_requests/26096
CVE-2026-95392[6]:
| MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://gitlab.com/wireshark/wireshark/-/issues/21549
https://gitlab.com/wireshark/wireshark/-/issues/21550
CVE-2026-95393[7]:
| CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-99
https://gitlab.com/wireshark/wireshark/-/issues/21510
CVE-2026-95394[8]:
| Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8
| and 4.4.0 to 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-98
https://gitlab.com/wireshark/wireshark/-/issues/21523
CVE-2026-95395[9]:
| IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0
| to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-96
https://gitlab.com/wireshark/wireshark/-/issues/21492
CVE-2026-96415[10]:
| Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and
| 4.4.0 to 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-110
https://gitlab.com/wireshark/wireshark/-/issues/21589
CVE-2026-96416[11]:
| IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to
| 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-109
https://gitlab.com/wireshark/wireshark/-/issues/21564
CVE-2026-96417[12]:
| RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-104
https://gitlab.com/wireshark/wireshark/-/issues/21574
CVE-2026-96418[13]:
| TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to
| 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-107
https://gitlab.com/wireshark/wireshark/-/issues/21565
CVE-2026-96419[14]:
| Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows
| denial of service and possible code execution
https://www.wireshark.org/security/wnpa-sec-2026-106
https://gitlab.com/wireshark/wireshark/-/issues/21553
CVE-2026-96420[15]:
| Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-105
https://gitlab.com/wireshark/wireshark/-/issues/21541
CVE-2026-96421[16]:
| USB HID protocol dissector infinite loop and memory leak in 4.6.0 to
| 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-103
https://gitlab.com/wireshark/wireshark/-/issues/21566
CVE-2026-96422[17]:
| Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to
| 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-102
https://gitlab.com/wireshark/wireshark/-/issues/21525
CVE-2026-96423[18]:
| X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-108
https://gitlab.com/wireshark/wireshark/-/issues/21563
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-95386
https://www.cve.org/CVERecord?id=CVE-2026-95386
[1] https://security-tracker.debian.org/tracker/CVE-2026-95387
https://www.cve.org/CVERecord?id=CVE-2026-95387
[2] https://security-tracker.debian.org/tracker/CVE-2026-95388
https://www.cve.org/CVERecord?id=CVE-2026-95388
[3] https://security-tracker.debian.org/tracker/CVE-2026-95389
https://www.cve.org/CVERecord?id=CVE-2026-95389
[4] https://security-tracker.debian.org/tracker/CVE-2026-95390
https://www.cve.org/CVERecord?id=CVE-2026-95390
[5] https://security-tracker.debian.org/tracker/CVE-2026-95391
https://www.cve.org/CVERecord?id=CVE-2026-95391
[6] https://security-tracker.debian.org/tracker/CVE-2026-95392
https://www.cve.org/CVERecord?id=CVE-2026-95392
[7] https://security-tracker.debian.org/tracker/CVE-2026-95393
https://www.cve.org/CVERecord?id=CVE-2026-95393
[8] https://security-tracker.debian.org/tracker/CVE-2026-95394
https://www.cve.org/CVERecord?id=CVE-2026-95394
[9] https://security-tracker.debian.org/tracker/CVE-2026-95395
https://www.cve.org/CVERecord?id=CVE-2026-95395
[10] https://security-tracker.debian.org/tracker/CVE-2026-96415
https://www.cve.org/CVERecord?id=CVE-2026-96415
[11] https://security-tracker.debian.org/tracker/CVE-2026-96416
https://www.cve.org/CVERecord?id=CVE-2026-96416
[12] https://security-tracker.debian.org/tracker/CVE-2026-96417
https://www.cve.org/CVERecord?id=CVE-2026-96417
[13] https://security-tracker.debian.org/tracker/CVE-2026-96418
https://www.cve.org/CVERecord?id=CVE-2026-96418
[14] https://security-tracker.debian.org/tracker/CVE-2026-96419
https://www.cve.org/CVERecord?id=CVE-2026-96419
[15] https://security-tracker.debian.org/tracker/CVE-2026-96420
https://www.cve.org/CVERecord?id=CVE-2026-96420
[16] https://security-tracker.debian.org/tracker/CVE-2026-96421
https://www.cve.org/CVERecord?id=CVE-2026-96421
[17] https://security-tracker.debian.org/tracker/CVE-2026-96422
https://www.cve.org/CVERecord?id=CVE-2026-96422
[18] https://security-tracker.debian.org/tracker/CVE-2026-96423
https://www.cve.org/CVERecord?id=CVE-2026-96423
Please adjust the affected versions in the BTS as needed.