CVE catalog

CVE-2022-0586

wireshark affected and fixed versions

Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Feb 10, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.00% · Oct 27, 2026

Projects and upstream resources

[wireshark][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	wireshark	`4.4.19-0+deb13u1`	Fixed	[CVE-2022-0586]
Debiantrixie	wireshark	`3.6.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-0586]
Debiantrixie	wireshark	`4.4.18-0+deb13u1`	Fixed	[CVE-2022-0586]
Debiansid	wireshark	`3.6.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-0586]
Debiansid	wireshark	`4.6.9-1`	Fixed	[CVE-2022-0586]
Debianforky	wireshark	`3.6.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-0586]
Debianforky	wireshark	`4.6.9-1`	Fixed	[CVE-2022-0586]
Debianbookworm-security	wireshark	`4.0.17-0+deb12u3`	Fixed	[CVE-2022-0586]
Debianbookworm	wireshark	`3.6.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-0586]
Debianbookworm	wireshark	`4.0.17-0+deb12u3`	Fixed	[CVE-2022-0586]

Showing 10 fix observations. All 18 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	wireshark	`3.6.2-1`	UnknownSource applicability is not established	Provider not reported
Debianbookworm	wireshark	`3.6.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-0586]
Debianbookworm	wireshark	`4.0.17-0+deb12u3`	Fixed	[CVE-2022-0586]
Debianbookworm-security	wireshark	`4.0.17-0+deb12u3`	Fixed	[CVE-2022-0586]
Debianforky	wireshark	`3.6.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-0586]
Debianforky	wireshark	`4.6.9-1`	Fixed	[CVE-2022-0586]
Debiansid	wireshark	`3.6.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-0586]
Debiansid	wireshark	`4.6.9-1`	Fixed	[CVE-2022-0586]
Debiantrixie	wireshark	`3.6.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-0586]
Debiantrixie	wireshark	`4.4.18-0+deb13u1`	Fixed	[CVE-2022-0586]
Debiantrixie-security	wireshark	`4.4.19-0+deb13u1`	Fixed	[CVE-2022-0586]
Ubuntupro	wireshark	`3.0.5-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-0586]Apr 22, 2026, 1:11:24 PM UTC
Ubuntupro	wireshark	`3.0.7-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-0586]Apr 22, 2026, 1:11:24 PM UTC
Ubuntupro	wireshark	`3.2.1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-0586]Apr 22, 2026, 1:11:24 PM UTC
Ubuntupro	wireshark	`3.2.2-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-0586]Apr 22, 2026, 1:11:24 PM UTC
Ubuntupro	wireshark	`3.2.3-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-0586]Apr 22, 2026, 1:11:24 PM UTC
Ubuntupro	wireshark	`3.2.3-1ubuntu0.1~esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-0586]Apr 22, 2026, 1:11:24 PM UTC
Ubuntupro	wireshark	`3.2.3-1ubuntu0.1~esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-0586]Apr 22, 2026, 1:11:24 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "wireshark",
      "status": "fixed",
      "release": "sid",
      "version": "4.6.9-1"
    },
    {
      "name": "wireshark",
      "status": "fixed",
      "release": "forky",
      "version": "4.6.9-1"
    },
    {
      "name": "wireshark",
      "status": "fixed",
      "release": "trixie",
      "version": "4.4.18-0+deb13u1"
    },
    {
      "name": "wireshark",
      "status": "fixed",
      "release": "trixie-security",
      "version": "4.4.19-0+deb13u1"
    },
    {
      "name": "wireshark",
      "status": "fixed",
      "release": "bookworm",
      "version": "4.0.17-0+deb12u3"
    },
    {
      "name": "wireshark",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "4.0.17-0+deb12u3"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "wireshark",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.2-1"
    },
    {
      "bug": null,
      "name": "wireshark",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.2-1"
    },
    {
      "bug": null,
      "name": "wireshark",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.2-1"
    },
    {
      "bug": null,
      "name": "wireshark",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.2-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "wireshark",
      "fixed_version": "3.6.2-1",
      "applicability_unknown": true
    },
    {
      "name": "wireshark",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.3-1ubuntu0.1~esm2"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "3.0.5-1",
        "3.0.7-1",
        "3.2.1-1",
        "3.2.2-1",
        "3.2.3-1",
        "3.2.3-1ubuntu0.1~esm1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-0586",
      "fixed_version": "3.2.3-1ubuntu0.1~esm2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-0586",
      "provider_updated_at": "2026-04-22T13:11:24.959431Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libwireshark16]Unknown
Source package: [wireshark]
Details (4)
- 4.0.17-0+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[libwireshark-data]Unknown
Source package: [wireshark]
Details (6)
- 4.0.17-0+deb12u3 · all · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · all · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · all · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · all · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.6-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.6-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[libwireshark-dev]Unknown
Source package: [wireshark]
Details (4)
- 4.0.17-0+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[libwiretap13]Unknown
Source package: [wireshark]
Details (4)
- 4.0.17-0+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[libwiretap-dev]Unknown
Source package: [wireshark]
Details (4)
- 4.0.17-0+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[libwsutil14]Unknown
Source package: [wireshark]
Details (4)
- 4.0.17-0+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[libwsutil-dev]Unknown
Source package: [wireshark]
Details (4)
- 4.0.17-0+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[tshark]Unknown
Source package: [wireshark]
Details (4)
- 4.0.17-0+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[wireshark]Unknown
Details (4)
- 4.0.17-0+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[wireshark-common]Unknown
Source package: [wireshark]
Details (4)
- 4.0.17-0+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[wireshark-dev]Unknown
Source package: [wireshark]
Details (4)
- 4.0.17-0+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[wireshark-doc]Unknown
Source package: [wireshark]
Details (6)
- 4.0.17-0+deb12u3 · all · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · all · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · all · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · all · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.6-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.6-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[wireshark-gtk]Unknown
Source package: [wireshark]
Details (2)
- 4.0.6-1~deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.6-1~deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
[wireshark-qt]Unknown
Source package: [wireshark]
Details (4)
- 4.0.17-0+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm
- 4.0.17-0+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 3.6.2-1
  dsa · wireshark · debian · bookworm

Observed: Oct 28, 2026, 6:16:38 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]