CVE-2026-48487
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In the Zeroconf library before version 0.149.16, the _read_character_string and _read_string functions in src/zeroconf/_protocol/incoming.py advance self.offset by attacker-declared RDLENGTH without checking it against self._data_len. Unauthenticated hosts on the local link over UDP/5353 can send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records.
Risk Assessment
An attacker on the local network can manipulate DNS data and service properties, potentially leading to traffic redirection or other attacks based on forged records.
Recommendation
Upgrade the Zeroconf library to version 0.149.16, which includes a fix that checks data length before processing.
Other vulnerabilities in Zeroconf
See all- CVE-2026-48045Medium
Zeroconf before version 0.149.12 contains a vulnerability leading to memory exhaustion and excessive CPU usage. Unauthenticated hosts on the local link over UDP/5353 can send crafted queries with the TC bit set, which are stored in `_deferred` and `_timers` dictionaries without size limits, causing memory exhaustion and quadratic CPU burn.
- CVE-2026-47184Medium
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, and broken discovery and registration.
- CVE-2026-47183Medium
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 to drive memory growth until OOM-killed.
- CVE-2026-47180Medium
Zeroconf before version 0.149.5 contains a recursion error vulnerability in the `DNSIncoming._decode_labels_at_offset` function. A single mDNS packet with chained compression pointers can trigger a RecursionError that escapes `DNSIncoming.__init__`, causing sustained CPU burn, log flooding, and degradation of mDNS-dependent services for unauthenticated hosts on the local link over UDP/5353.
Original NVD description (English source)
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.