The Wireshark Foundation has released Wireshark 4.6.1, a critical maintenance update addressing multiple crash-inducing vulnerabilities in the world’s most popular network protocol analyzer.
This latest release focuses on fixing security flaws and stability issues that could disrupt network analysis operations for professionals and organizations worldwide.
Critical Security Patches Deployed
Wireshark 4.6.1 addresses two significant security vulnerabilities identified in the recent version.
The first issue, tracked as wnpa-sec-2025-05, involves a crash in the BPv7 dissector that could completely halt network analysis tasks during packet inspection.
The second vulnerability, designated as wnpa-sec-2025-06, affects the Kafka dissector and presents similar crash-inducing behavior when processing specific network traffic.
Both vulnerabilities were documented under Issues 20770 and 20823, respectively, on the project’s GitLab repository.
These security patches are essential for organizations and professionals who rely on Wireshark for network troubleshooting, security analysis, and protocol development.
The crashes could interrupt critical network investigations or monitoring activities, making this update a high priority for users in the cybersecurity and network administration community.
Beyond the critical security vulnerabilities, Wireshark 4.6.1 resolves numerous bugs that previously affected user experience and functionality.
The update fixes a long-standing issue with the L2CAP dissector’s inability to handle retransmission mode properly. This problem has existed since earlier versions.
The DNS HIP dissector now correctly labels PK algorithm information, rather than incorrectly labeling it as HIT length data.
Several crash-related bugs were addressed immediately in this release. TShark crashes caused by Lua plugins have been fully resolved, along with essential fixes for FileHandler crashes when reading packets from capture files.
The update also addresses performance issues, including system stalls that occurred when analysts selected specific messages during active analysis sessions.
| Vulnerability/Bug ID | Component | Description |
|---|---|---|
| wnpa-sec-2025-05 | BPv7 Dissector | Dissector crash during packet analysis |
| wnpa-sec-2025-06 | Kafka Dissector | Dissector crash when processing traffic |
| Issue 2241 | L2CAP Dissector | Doesn’t understand retransmission mode |
| Issue 20768 | DNS HIP Dissector | PK algorithm labeled as HIT length |
| Issue 20776 | ZBee Direct | clang-cl error in packet-zbee-direct.c |
| Issue 20779 | File Handling | LZ4-compressed output file write failures |
| Issue 20786 | Plugin Building | endian.h conflicts with libc |
| Issue 20794 | TShark | TShark crash caused by Lua plugin |
| Issue 20797 | UI Performance | System stalls when selecting messages |
| Issue 20802 | TLS Handling | Abbreviated Handshake using New Session Ticket |
| Issue 20803 | Websocket | Custom websocket dissector not executing |
| Issue 20813 | DCERPC | WINREG QueryValue triggers dissector bug |
| Issue 20817 | Lua | FileHandler crash when reading packets |
| Issue 20818 | Display Filter | FT_NONE/BASE_NONE field filtering issue |
| Issue 20819 | UI Layout | Pane 3 selection issues with Packet Diagram |
| Issue 20820 | TCP Dissector | Invalid packet diagram creation |
| Issue 20831 | VLAN | Excessive nested VLAN tags |
| Issue 20842 | File Format | Omnipeek files not working in 4.6.0 |
| Issue 20845 | IsoBus Dissector | UTF-16 string support for string operations |
| Issue 20849 | SNMP | getBulkRequest request-id filtering issue |
| Issue 20852 | Fuzzing | Crash on specific fuzzer test case |
| Issue 20856 | Protocol Decoding | UDP Port 853 (DoQ) decoded as QUIC |
File handling improvements include critical fixes for LZ4-compressed output files that previously failed during write operations.
Users working with Omnipeek files will find that compatibility issues present in version 4.6.0 have been fully corrected.
The release also resolves issues with VLAN tag processing and failures in the execution of the custom WebSocket dissector.
Wireshark 4.6.1 includes comprehensive updates to over 30 protocols, significantly enhancing the analyzer’s ability to decode modern network traffic accurately.
Updated protocols include 802.11 Radiotap, DNS, DTLS, HTTP, HTTP3, SMB, SNMP, TCP, and TLS, among many others.
These improvements ensure accurate analysis of contemporary network communications across diverse environments.
The Wireshark Foundation continues to depend on community contributions and sponsorships to maintain and develop the software.
Users can download Wireshark 4.6.1 from the official Wireshark website, with installation packages available for Windows, macOS, and Linux platforms.
Network professionals and security analysts are strongly encouraged to update immediately to benefit from these critical security and stability improvements.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and set GBH as a Preferred Source in Google.
