PT-2026-45026 · Pypi · Zeroconf
CVE-2026-47184
·
Published
2026-05-29
·
Updated
2026-07-21
CVSS v3.1
6.5
Medium
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
zeroconf versions prior to 0.149.6
Description
An unauthenticated host on the local link can send multicast mDNS responses with unique names to the
DNSCache. async add function, causing records to accumulate in cache, expirations, expire heap, and service cache without a cap on the entry count. This can lead to an Out-of-Memory (OOM) condition that kills the process on memory-constrained hardware. Additionally, a high volume of records can slow down cache lookups and periodic expiry passes, starving the asyncio event loop and disrupting discovery, registration, and ServiceBrowser callbacks. A second variant involves re-multicasting cached records with shifting TTLs, which causes the expire heap to grow unbounded between cleanup runs.Recommendations
Upgrade to version 0.149.6 or later.
Restrict mDNS traffic on UDP port 5353 to trusted Layer-2 segments using host firewall rules, guest-network separation, or AP client isolation.
Exploit
Fix
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Zeroconf