01 Record

CVE-2022-0581

Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file

MediumPUBLISHEDCNA: GitLab

CNA base score6.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

View raw JSON

02 Description

Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 1.84% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 77.1% of scored records. A rank, not a probability.
NVD base score: 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2022-02-14 00:00Z4 YR AGO

Last updated

2025-11-03 21:45Z10 MO AGO

Reserved

2022-02-14

Assigning CNA

GitLab

Record state

PUBLISHED

Severity

Medium (CVSS 6.3)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weaknesses

CWE-416Use After FreeVariant
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Class

Data version

5.2

Document digest

22ee02081b0f424a215ad1562a0ed1d7df37c854504b03624050fa1e82a5213a

05 Affected products

VendorProductVersionsPlatforms

Wireshark FoundationWireshark>=3.6.0, <3.6.2, >=3.4.0, <3.4.12—

06 References

www.wireshark.orghttps://www.wireshark.org/security/wnpa-sec-2022-05.html
gitlab.comhttps://gitlab.com/wireshark/wireshark/-/issues/17935
gitlab.comhttps://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0581.json
lists.fedoraproject.orgFEDORA-2022-5a3603afe0https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRJ24JRKLA6XMDKLGVTOPM5KBBU4UHLN/vendor-advisory
lists.fedoraproject.orgFEDORA-2022-e29665a42bhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3DZD2JU56ZI4XV2B3HGVGA5PXQDNA5T/vendor-advisory
lists.debian.org[debian-lts-announce] 20220331 [SECURITY] [DLA 2967-1] wireshark security updatehttps://lists.debian.org/debian-lts-announce/2022/03/msg00041.htmlmailing-list
security.gentoo.orgGLSA-202210-04https://security.gentoo.org/glsa/202210-04vendor-advisory
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2024/09/msg00049.html

01 Record index

CVE-2022-0581

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2022-0581

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References