CVE-2026-47184
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, and broken discovery and registration.
Risk Assessment
The risk includes memory exhaustion, performance degradation, and disruption of service discovery and registration functions.
Recommendation
It is recommended to upgrade the Zeroconf library to version 0.149.7 or later.
Other vulnerabilities in Zeroconf
See all- CVE-2026-48487Medium
In the Zeroconf library before version 0.149.16, the _read_character_string and _read_string functions in src/zeroconf/_protocol/incoming.py advance self.offset by attacker-declared RDLENGTH without checking it against self._data_len. Unauthenticated hosts on the local link over UDP/5353 can send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records.
- CVE-2026-48045Medium
Zeroconf before version 0.149.12 contains a vulnerability leading to memory exhaustion and excessive CPU usage. Unauthenticated hosts on the local link over UDP/5353 can send crafted queries with the TC bit set, which are stored in `_deferred` and `_timers` dictionaries without size limits, causing memory exhaustion and quadratic CPU burn.
- CVE-2026-47183Medium
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 to drive memory growth until OOM-killed.
- CVE-2026-47180Medium
Zeroconf before version 0.149.5 contains a recursion error vulnerability in the `DNSIncoming._decode_labels_at_offset` function. A single mDNS packet with chained compression pointers can trigger a RecursionError that escapes `DNSIncoming.__init__`, causing sustained CPU burn, log flooding, and degradation of mDNS-dependent services for unauthenticated hosts on the local link over UDP/5353.
Original NVD description (English source)
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, slower async_expire passes, and broken discovery, registration, and ServiceBrowser callbacks. This issue is fixed in version 0.149.7.