PT-2026-45025 · Pypi · Zeroconf
CVE-2026-47183
·
Published
2026-05-29
·
Updated
2026-07-17
CVSS v3.1
6.5
Medium
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
zeroconf versions prior to 0.149.6
Description
An unauthenticated host on the local link can cause excessive memory growth by sending malformed packets to UDP port 5353. The
DNSIncoming. log exception debug function and QuietLogger exception-deduplication methods use an unbounded seen logs dictionary. When IncomingDecodeError messages are raised from read name() or decode labels at offset(), the dictionary keys are generated using the peer's ephemeral source port, byte offset, and pointer link. Because these values vary per packet, each unique malformed packet creates a new entry that retains the raw inbound packet data (up to 8966 bytes) in memory until the process exits. This can lead to an Out-Of-Memory (OOM) condition, causing the process to be killed and resulting in the failure of mDNS-dependent features such as HomeKit, AirPlay, and Chromecast/Matter.Recommendations
Upgrade to version 0.149.6 or later.
Restrict mDNS (UDP/5353) to trusted Layer-2 segments using host firewall rules, guest-network separation, or AP client isolation.
Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zeroconf