Zeroconf vulnerabilities

In the Zeroconf library before version 0.149.16, the _read_character_string and _read_string functions in src/zeroconf/_protocol/incoming.py advance self.offset by attacker-declared RDLENGTH without checking it against self._data_len. Unauthenticated hosts on the local link over UDP/5353 can send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records.

Zeroconf before version 0.149.12 contains a vulnerability leading to memory exhaustion and excessive CPU usage. Unauthenticated hosts on the local link over UDP/5353 can send crafted queries with the TC bit set, which are stored in `_deferred` and `_timers` dictionaries without size limits, causing memory exhaustion and quadratic CPU burn.

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, and broken discovery and registration.

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 to drive memory growth until OOM-killed.

Zeroconf before version 0.149.5 contains a recursion error vulnerability in the `DNSIncoming._decode_labels_at_offset` function. A single mDNS packet with chained compression pointers can trigger a RecursionError that escapes `DNSIncoming.__init__`, causing sustained CPU burn, log flooding, and degradation of mDNS-dependent services for unauthenticated hosts on the local link over UDP/5353.