CVE-2024-11595

What it actually does

Infinite loop in the FiveCo RAP dissector causes Wireshark to hang or crash when processing specially crafted network packets or capture files.

Why it matters to the business

Network analysts experience disrupted workflows and delayed troubleshooting when examining traffic captures, potentially slowing incident response and security investigations across environments using the affected versions.

How an attack unfolds

An attacker creates a malicious packet or capture file that exploits a flaw in the FiveCo RAP protocol parsing logic; when a victim opens the file or processes the traffic in a vulnerable Wireshark instance, the dissector enters an infinite loop resulting in denial of service.

How to fix it

Upgrade Wireshark to a build containing commit 9947b17309f435fe6d3dfe5595f43995cb42709e or later; avoid opening untrusted capture files until patched.

How to confirm the fix worked

Confirm the installed Wireshark version includes the referenced commit; test parsing of known-triggering packets to verify the loop condition is resolved.

Typical attack path

1. Craft a malicious capture file or inject packets targeting the FiveCo RAP dissector
2. Deliver the file to the target analyst or place it in monitored network traffic
3. Victim opens the capture or processes live traffic with vulnerable Wireshark
4. Dissector enters infinite loop causing application hang or crash

How to detect it

Review system and application logs for Wireshark process hangs or high CPU usage during capture file processing; correlate with recent file opens involving protocol dissectors.

What your security team should do

• Apply the fixed commit or newer Wireshark release as soon as possible
• Restrict opening of capture files from untrusted sources
• Monitor Wireshark usage for unexpected hangs during protocol analysis