# CVE-2017-5596: Wireshark ASTERIX dissector infinite loop denial of service

Source: https://junglewise.ai/threats/cve-2017-5596-wireshark-asterix-dissector-infinite-loop-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-25. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5596 · Severity: high · CVSS 7.5 · Published 2017-01-25

Wireshark, a widely used network protocol analyzer, is vulnerable to a flaw that can cause the application to hang or become unresponsive. By sending a specially crafted network packet or tricking a user into opening a malicious capture file, an attacker can force the software into an infinite loop. This results in a denial-of-service, preventing security teams from monitoring network traffic and potentially impacting the stability of the system running the software.

Technologies: [Wireshark](https://junglewise.ai/threats/technologies/wireshark). Vendors: [Wireshark](https://junglewise.ai/threats/vendors/wireshark).

## Quick answers

**Is CVE-2017-5596 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5596 being exploited in the wild.

**How severe is CVE-2017-5596?** High severity, with a CVSS score of 7.5, published 25 January 2017.

**Which products and versions are affected?** Wireshark 2.0.0 to 2.0.9, 2.2.0 to 2.2.3.

**Is there a fix for CVE-2017-5596?** A patch was published on 2017-03-18: Debian released security update DSA-3811-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5596 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2017-5596?** Check whether you run Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An infinite loop vulnerability exists in the ASTERIX dissector (packet-asterix.c) of Wireshark due to an integer overflow. When processing malformed packets or fuzzed PCAP files, a data type mismatch in the dissection engine prevents the loop exit condition from being met. This can be triggered remotely via packet injection or locally via a malformed capture file. The flaw allows an unauthenticated attacker to cause 100% CPU exhaustion and application unresponsiveness (Denial of Service). The issue was resolved by updating the data types used in the dissector to correctly handle large or unexpected values.

## Affected products

- Wireshark Wireshark 2.0.0 to 2.0.9, 2.2.0 to 2.2.3

## Timeline

- 2017-01-23: advisory: Vendor advisory wnpa-sec-2017-01 published
- 2017-01-25: disclosed: CVE-2017-5596 published to NVD
- 2017-03-18: patched: Debian released security update DSA-3811-1

## References

- [http://www.debian.org/security/2017/dsa-3811](http://www.debian.org/security/2017/dsa-3811)
- [http://www.securityfocus.com/bid/95795](http://www.securityfocus.com/bid/95795)
- [http://www.securitytracker.com/id/1037694](http://www.securitytracker.com/id/1037694)
- [https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13344](https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13344)
- [https://code.wireshark.org/review/](https://code.wireshark.org/review/)
- [https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=781f03580c81339513bb1238b202b72469a1240b](https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=781f03580c81339513bb1238b202b72469a1240b)
- [https://www.wireshark.org/security/wnpa-sec-2017-01.html](https://www.wireshark.org/security/wnpa-sec-2017-01.html)

## Related threats

- [Wireshark USB HID dissector infinite loop in Usage range parsing](https://junglewise.ai/threats/cve-2026-96421-usb-hid-protocol-dissector-infinite-loop-and-memory-leak-in-4-6-0)
- [Wireshark pcapng file parser heap out-of-bounds read](https://junglewise.ai/threats/cve-2026-76929-wireshark-pcapng-file-parser-heap-out-of-bounds-read)
- [Wireshark Kerberos dissector heap buffer overflow](https://junglewise.ai/threats/cve-2026-76924-wireshark-kerberos-dissector-heap-buffer-overflow)
- [Wireshark CMS protocol dissector heap-use-after-free](https://junglewise.ai/threats/cve-2026-76921-wireshark-cms-protocol-dissector-heap-use-after-free)
- [Wireshark ESS protocol dissector crash via uninitialized pointer](https://junglewise.ai/threats/cve-2026-76919-wireshark-ess-protocol-dissector-crash-via-uninitialized-pointer)