# CVE-2017-5597: Wireshark DHCPv6 dissector integer overflow denial of service

Source: https://junglewise.ai/threats/cve-2017-5597-wireshark-dhcpv6-dissector-integer-overflow-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-25. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5597 · Severity: high · CVSS 7.5 · Published 2017-01-25

Wireshark, a widely used network protocol analyzer, is vulnerable to a denial-of-service attack. By sending a specially crafted network packet or providing a malicious capture file, an attacker can cause the software to enter an infinite loop. This results in the application becoming unresponsive and consuming excessive processor resources, potentially disrupting network monitoring and troubleshooting operations.

Technologies: [Wireshark](https://junglewise.ai/threats/technologies/wireshark). Vendors: [Wireshark](https://junglewise.ai/threats/vendors/wireshark).

## Quick answers

**Is CVE-2017-5597 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5597 being exploited in the wild.

**How severe is CVE-2017-5597?** High severity, with a CVSS score of 7.5, published 25 January 2017.

**Which products and versions are affected?** Wireshark 2.0.0 to 2.0.9, 2.2.0 to 2.2.3.

**Is there a fix for CVE-2017-5597?** A patch was published on 2017-03-18: Debian security update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5597 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2017-5597?** Check whether you run Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in the DHCPv6 dissector (epan/dissectors/packet-dhcpv6.c) of Wireshark. The flaw is triggered when the dissector processes a malformed DHCPv6 packet, either via live network injection or by loading a crafted PCAP file. This causes the dissection engine to enter a large or infinite loop, leading to 100% CPU utilization and application hang (Denial of Service). The issue was resolved by updating the data types used in the loop logic to prevent the overflow. Patches are available in versions 2.0.10 and 2.2.4.

## Affected products

- Wireshark Wireshark 2.0.0 to 2.0.9, 2.2.0 to 2.2.3

## Timeline

- 2017-01-23: advisory: Vendor advisory WNPA-SEC-2017-02 released
- 2017-01-25: disclosed: NVD publication date
- 2017-03-18: patched: Debian security update released

## References

- [http://www.debian.org/security/2017/dsa-3811](http://www.debian.org/security/2017/dsa-3811)
- [http://www.securityfocus.com/bid/95798](http://www.securityfocus.com/bid/95798)
- [http://www.securitytracker.com/id/1037694](http://www.securitytracker.com/id/1037694)
- [https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13345](https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13345)
- [https://code.wireshark.org/review/](https://code.wireshark.org/review/)
- [https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=57894f741f7cc98b46c9fdce7eee8256d2a4ae3f](https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=57894f741f7cc98b46c9fdce7eee8256d2a4ae3f)
- [https://www.wireshark.org/security/wnpa-sec-2017-02.html](https://www.wireshark.org/security/wnpa-sec-2017-02.html)

## Related threats

- [Wireshark USB HID dissector infinite loop in Usage range parsing](https://junglewise.ai/threats/cve-2026-96421-usb-hid-protocol-dissector-infinite-loop-and-memory-leak-in-4-6-0)
- [Wireshark pcapng file parser heap out-of-bounds read](https://junglewise.ai/threats/cve-2026-76929-wireshark-pcapng-file-parser-heap-out-of-bounds-read)
- [Wireshark Kerberos dissector heap buffer overflow](https://junglewise.ai/threats/cve-2026-76924-wireshark-kerberos-dissector-heap-buffer-overflow)
- [Wireshark CMS protocol dissector heap-use-after-free](https://junglewise.ai/threats/cve-2026-76921-wireshark-cms-protocol-dissector-heap-use-after-free)
- [Wireshark ESS protocol dissector crash via uninitialized pointer](https://junglewise.ai/threats/cve-2026-76919-wireshark-ess-protocol-dissector-crash-via-uninitialized-pointer)