PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-6470 Wireshark CVE debrief

CVE-2017-6470 is a denial-of-service issue in Wireshark’s IAX2 dissector. A malformed capture file or injected packet could trigger an infinite loop while processing IAX2 traffic, which can hang the application and stop analysis. NVD rates the issue 7.5 HIGH with a CVSS v3.0 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The affected ranges listed by NVD are Wireshark 2.0.0 through 2.0.10 and 2.2.0 through 2.2.4, with the issue addressed by constraining packet lateness in packet-iax2.c.

Vendor
Wireshark
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-04
Original CVE updated
2026-05-13
Advisory published
2017-03-04
Advisory updated
2026-05-13

Who should care

Security teams, network analysts, and anyone using Wireshark to open untrusted capture files or inspect live traffic should care, especially in environments where malformed packets can be introduced into analysis workflows.

Technical summary

NVD identifies the weakness as CWE-835 (infinite loop). The vulnerability is in the IAX2 dissector (epan/dissectors/packet-iax2.c) and can be triggered by packet injection or a malformed capture file. The result is availability impact only: Wireshark may become stuck in an infinite loop and stop responding. NVD lists affected versions as 2.0.0-2.0.10 and 2.2.0-2.2.4, and the referenced Wireshark fix constrains packet lateness.

Defensive priority

High for organizations that routinely process untrusted packet captures or live network data. The bug is remotely triggerable through malformed traffic/captures and can cause a reliable availability impact in a core analysis tool.

Recommended defensive actions

  • Upgrade Wireshark to a version newer than 2.0.10 or 2.2.4, using vendor guidance from the Wireshark security advisory.
  • Treat untrusted capture files and packet feeds as potentially disruptive inputs until patched.
  • If you operate automated capture-processing or analysis pipelines, add watchdogs/timeouts so a hang in a dissector does not stall the whole workflow.
  • Review environments that rely on Debian packages or other downstream distributions for patch status, since NVD lists Debian Linux 8.0 as affected in its CPE data.
  • Use the linked Wireshark bug and commit references to confirm the presence of the fix in your deployed build line.

Evidence notes

This debrief is grounded in the supplied NVD record and its listed references. The core facts used here are: the IAX2 infinite loop description, the affected Wireshark version ranges, the CWE-835 classification, the CVSS v3.0 vector, and the referenced fix in packet-iax2.c that constrains packet lateness. The references also include the Wireshark bug tracker entry, a source commit, the Wireshark security advisory, and third-party advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-6470 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-6470

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-6470 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-6470

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.