Description

SSH protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-19T23:16:20.487Z",
  "pubdate": "2026-08-19T23:16:20.487Z",
  "executiveSummary": "This vulnerability involves a denial of service condition residing within the SSH protocol dissector across specific software versions. The flaw allows remote unauthenticated attackers to crash the affected application by sending malformed or specifically crafted SSH network traffic.\nThe primary impact of successful exploitation is complete service unavailability, leading to application crashes and disruption of network analysis or monitoring capabilities. Affected systems include software deployments running versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18.\nThe risk implication is critical for environments relying on continuous packet analysis, as a single malicious stream can disrupt operations. The attacker capabilities require network access to the target system where the dissector processes incoming traffic, with no prior authentication or elevated privileges required to trigger the crash condition.",
  "technicalDetails": "The root cause of the vulnerability stems from improper input validation and exception handling within the SSH protocol dissector component when parsing anomalous or malformed packet structures. Specifically, when the dissector encounters unexpected data fields, length mismatches, or corrupted protocol headers during SSH session analysis, it fails to handle the exception gracefully.\nThe vulnerable component is the internal SSH protocol dissector routine responsible for decoding packet payloads and extracting state information. Affected versions include 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. Exploitation occurs over the network where the vulnerable application is actively capturing or processing live traffic streams or reading packet capture files.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious sequence of bytes mimicking SSH protocol headers or transport layer packets designed to violate expected schema constraints. Second, the attacker transmits this crafted payload across the network toward the vulnerable system, or ensures it is ingested by the packet processing engine. Third, the SSH protocol dissector attempts to parse the anomalous payload structure. Fourth, the lack of boundary checks or null-pointer validations triggers an unhandled memory exception, assertion failure, or segmentation fault within the parsing routine. Finally, this unhandled exception forces the host application process to terminate abruptly, resulting in a denial of service.\nAuthentication requirements are nonexistent, as the flaw resides in early-stage protocol parsing layers before any session handshake or authentication takes place. Privilege requirements are also absent; any entity capable of transmitting network traffic to the parser or supplying a malicious capture file can trigger the condition. The payload behavior is strictly destructive to the runtime process, inducing an immediate crash without yielding arbitrary code execution capabilities based on available telemetry."
}