CVE-2024-0208 is a high severity (CVSS 7.8) denial of service flaw in the GVCP dissector of Wireshark 4.2.0, 4.0.0 to 4.0.11 and 3.6.0 to 3.6.19. Upgrade to 4.2.1, 4.0.12 or 3.6.20.
What's affected
The Wireshark advisory lists these affected versions: 4.2.0, 4.0.0 through 4.0.11, and 3.6.0 through 3.6.19. The fixed versions are 4.2.1, 4.0.12 and 3.6.20. Pick the one that matches the branch you run, or move to the latest 4.2 release.
How to check if you're exposed
Wireshark and TShark both print their version on the command line, so this works on any machine where either is installed:
wireshark --version
tshark --version
On Debian or Ubuntu you can also list the installed package with apt list --installed 'wireshark*'. On Windows and macOS, open Help and then About Wireshark. Compare the number you see with the affected range above.
Also look beyond workstations. Wireshark and TShark turn up on jump hosts, build agents, packet capture appliances and in container images that analysts built once and forgot. A CI job that runs TShark against capture files is an easy one to miss. If you keep software inventories or SBOMs, search them for wireshark and tshark. The free in-browser dependency scan can also read a manifest if Wireshark is vendored in a project.
What to do now
- Find every install of Wireshark and TShark, including analyst laptops, jump hosts and CI images.
- Upgrade to 4.2.1, 4.0.12 or 3.6.20 or later using your normal package channel or the installer from the Wireshark project.
- Until the upgrade lands, avoid opening capture files from sources you do not trust, and do not run live captures on hostile networks with an affected build.
- If TShark processes capture files automatically, pause that job or run it in a throwaway container on an affected version.
- Rebuild any image that bundles Wireshark so the fixed version ships in the next build.
Why it matters
The Wireshark advisory describes the problem briefly: the dissector could crash, either when someone injects a malformed packet onto the network or when a user opens a malformed capture file. It names no workaround, and says to upgrade. We have no more detail on the root cause than that, and we will not speculate.
The weakness class in the record is CWE-230 (improper handling of missing values). The record names the weakness as improper handling of missing values, and the advisory says only that the dissector could crash.
One thing is worth stating plainly. The record's CVSS 3.1 vector rates confidentiality, integrity and availability impact all as high, which gives 7.8, while the advisory itself only describes a crash. Both are quoted here because they disagree in tone. For planning, treat the realistic outcome as a denial of service in a tool that analysts depend on, and treat the score as a reason to patch promptly. The vector also needs a user action (UI:R) and local access (AV:L), which fits the capture file case. The CISA Known Exploited Vulnerabilities flag for this record is false, and the advisory does not mention exploitation.
Quick check
Is there a workaround for CVE-2024-0208?
The Wireshark advisory lists none. Its stated resolution is to upgrade to 4.2.1, 4.0.12 or 3.6.20 or later.
Does this need a live attack on my network?
The advisory says a crash can come from a malformed packet injected onto the network or from opening a malformed capture file. Both paths lead to a crash of the application.
Sources
- Wireshark security advisory wnpa-sec-2024-01
- Wireshark issue 19496
- Gold entry for CVE-2024-0208
- Debian LTS announcement
Last reviewed: 19 October 2026.
