Back www.wireshark.org

CVE-2025-13945

www.wireshark.org • October 22, 2026

The HTTP3 dissector could crash when decrypting traffic using a keylog file or loading a capture file that contains decryption secrets.

Discovered by Sébastien Féry. We are unaware of any exploits for this issue. It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

Upgrade to Wireshark 4.6.2, 4.4.12 or later.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

QPACK Vulnerabilities Allow Denial-of-Service Attacks on HTTP/3 Servers A security firm, FoxIO, disclosed multiple vulnerabilities in QPACK, the header-compression system for HTTP/3, which can allow unauthenticated remote attackers to crash servers by causing excessive memory allocation. The flaws affect seven out of ten tested HTTP/3 stacks, leading to denial-of-service (DoS) conditions without evidence of data theft or code execution. Proof-of-concept code has been released, and while some stacks have been patched, others remain vulnerable as of October 22, 2026. The affected stacks include quic-go, Bun, and lsquic, with fixes available for some but not all. The vulnerabilities arise from improper handling of decoded header limits, allowing small requests to expand into large memory usage. Notably, the Bun HTTP/3 server is particularly vulnerable, with FoxIO reporting that it can lead to a CPU overload and server crash. No has been reported in the wild, but the potential for abuse is significant. 2 sources 58

Extracted Entities

CVEs (1)

CVE-2025-13945

Tools (1)

Wireshark