# ALAS2023-2026-3252: Security update for 4 packages

ALAS2023-2026-3252, released November 7, 2026, fixes 18 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-3252
- Platform: Linux
- Released: Nov 7, 2026
- Priority: High (Closes CVE-2026-95389, high severity)
- CVEs: 18, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-3252.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [wireshark-cli](https://patchblox.com/security/data/product/linux/wireshark-cli.md) | amzn 2023 | 1:4.6.9-1.amzn2023.0.2 |
| [wireshark-cli-debuginfo](https://patchblox.com/security/data/product/linux/wireshark-cli-debuginfo.md) | amzn 2023 | 1:4.6.9-1.amzn2023.0.2 |
| [wireshark-debugsource](https://patchblox.com/security/data/product/linux/wireshark-debugsource.md) | amzn 2023 | 1:4.6.9-1.amzn2023.0.2 |
| [wireshark-devel](https://patchblox.com/security/data/product/linux/wireshark-devel.md) | amzn 2023 | 1:4.6.9-1.amzn2023.0.2 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-95389](https://patchblox.com/security/data/cve/CVE-2026-95389.md) | High | wireshark: SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 8.1 | 0.0034 |  |
| [CVE-2026-95387](https://patchblox.com/security/data/cve/CVE-2026-95387.md) | High | wireshark: The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a comput... | 8.8 | 0.0026 |  |
| [CVE-2026-96423](https://patchblox.com/security/data/cve/CVE-2026-96423.md) | High | wireshark: X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 7.1 | 0.0014 |  |
| [CVE-2026-95386](https://patchblox.com/security/data/cve/CVE-2026-95386.md) | Routine | wireshark: TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service | 5.5 | 0.0027 |  |
| [CVE-2026-95390](https://patchblox.com/security/data/cve/CVE-2026-95390.md) | Routine | wireshark: PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of service | 5.5 | 0.0027 |  |
| [CVE-2026-95392](https://patchblox.com/security/data/cve/CVE-2026-95392.md) | Routine | wireshark: MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 5.5 | 0.0016 |  |
| [CVE-2026-96417](https://patchblox.com/security/data/cve/CVE-2026-96417.md) | Routine | wireshark: RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 5.5 | 0.0015 |  |
| [CVE-2026-95394](https://patchblox.com/security/data/cve/CVE-2026-95394.md) | Routine | wireshark: Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 4.7 | 0.0014 |  |
| [CVE-2026-96422](https://patchblox.com/security/data/cve/CVE-2026-96422.md) | Routine | wireshark: Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 5.5 | 0.0014 |  |
| [CVE-2026-96416](https://patchblox.com/security/data/cve/CVE-2026-96416.md) | Routine | wireshark: IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 5.5 | 0.0014 |  |
| [CVE-2026-96418](https://patchblox.com/security/data/cve/CVE-2026-96418.md) | Routine | wireshark: TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 5.5 | 0.0014 |  |
| [CVE-2026-96421](https://patchblox.com/security/data/cve/CVE-2026-96421.md) | Routine | wireshark: USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 5.5 | 0.0014 |  |
| [CVE-2026-95388](https://patchblox.com/security/data/cve/CVE-2026-95388.md) | Routine | wireshark: Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 5.5 | 0.0014 |  |
| [CVE-2026-95395](https://patchblox.com/security/data/cve/CVE-2026-95395.md) | Routine | wireshark: IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 5.5 | 0.0014 |  |
| [CVE-2026-96415](https://patchblox.com/security/data/cve/CVE-2026-96415.md) | Routine | wireshark: Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 5.5 | 0.0014 |  |
| [CVE-2026-95393](https://patchblox.com/security/data/cve/CVE-2026-95393.md) | Routine | wireshark: CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 4.7 | 0.0013 |  |
| [CVE-2026-95391](https://patchblox.com/security/data/cve/CVE-2026-95391.md) | Routine | wireshark: ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service | 5.5 | 0.0010 |  |
| [CVE-2026-96420](https://patchblox.com/security/data/cve/CVE-2026-96420.md) | Routine | wireshark: Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 5.5 | 0.0009 |  |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.