CVE-2026-34933

MediumCVSS 5.5

Published: 03/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

Avahi, a system for service discovery on a local network via mDNS/DNS-SD, prior to version 0.9-rc4 is vulnerable to a DoS attack. Any unprivileged local user can send a single D-Bus method call with conflicting publish flags, causing avahi-daemon to crash.

Risk Assessment

An attacker can crash the Avahi service, disrupting service discovery on the local network and potentially affecting other services dependent on mDNS/DNS-SD.

Recommendation

It is recommended to update Avahi to version 0.9-rc4 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.