CVE-2020-26422 Memory corruption in Wireshark
A buffer overflow in the QUIC dissector allows attackers to cause a denial of service via crafted packets or capture files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-26422?
CVE-2020-26422 is a low-severity memory corruption vulnerability in Oracle Zfs Storage Appliance Kit, published on 21 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file
Weakness: CWE-120
Which versions are affected by CVE-2020-26422?
It affects 2 products.
Products include Oracle Zfs Storage Appliance Kit, Wireshark Wireshark.
How do I fix CVE-2020-26422?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-26422 being exploited?
There is no known exploitation of CVE-2020-26422 in the wild and no public exploit code.
Other vulnerabilities in Oracle Zfs Storage Appliance Kit
- CVE-2022-21513 Privilege escalation in Sun ZFS Storage Appliance Kit (AK) Software
- CVE-2025-62290 Auth bypass in Oracle ZFS Storage Appliance Kit
- CVE-2024-21104 Privilege escalation in Sun ZFS Storage Appliance Kit (AK) Software
- CVE-2025-53046 Denial of service in Oracle ZFS Storage Appliance Kit
- CVE-2025-62289 Denial of service in Oracle ZFS Storage Appliance Kit
Sources
Also known as GHSA-f986-fpv9-3cm7, UBUNTU-CVE-2020-26422.