CVE-2026-48045
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Zeroconf before version 0.149.12 contains a vulnerability leading to memory exhaustion and excessive CPU usage. Unauthenticated hosts on the local link over UDP/5353 can send crafted queries with the TC bit set, which are stored in `_deferred` and `_timers` dictionaries without size limits, causing memory exhaustion and quadratic CPU burn.
Risk Assessment
The risk is a potential DoS attack on the Zeroconf service, disrupting mDNS-dependent services on the local network.
Recommendation
It is recommended to upgrade the Zeroconf library to version 0.149.12 or later, which includes a fix that limits list sizes and prevents memory exhaustion.
Other vulnerabilities in Zeroconf
See all- CVE-2026-48487Medium
In the Zeroconf library before version 0.149.16, the _read_character_string and _read_string functions in src/zeroconf/_protocol/incoming.py advance self.offset by attacker-declared RDLENGTH without checking it against self._data_len. Unauthenticated hosts on the local link over UDP/5353 can send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records.
- CVE-2026-47184Medium
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, and broken discovery and registration.
- CVE-2026-47183Medium
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 to drive memory growth until OOM-killed.
- CVE-2026-47180Medium
Zeroconf before version 0.149.5 contains a recursion error vulnerability in the `DNSIncoming._decode_labels_at_offset` function. A single mDNS packet with chained compression pointers can trigger a RecursionError that escapes `DNSIncoming.__init__`, causing sustained CPU burn, log flooding, and degradation of mDNS-dependent services for unauthenticated hosts on the local link over UDP/5353.
Original NVD description (English source)
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12.