CVE-2026-24401
Avahi has Uncontrolled Recursion in lookup_handle_cname function
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Avahi has Uncontrolled Recursion in lookup_handle_cname function
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.
- Record
CVE-2026-24401- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
EUVDEUVD-2026-4603
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.
- Record
EUVD-2026-4603- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.
- Record
CVE-2026-24401- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-24401
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.
- Record
ALPINE-CVE-2026-24401- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2026-24401
- Record
BELL-CVE-2026-24401- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
Avahi has Uncontrolled Recursion in lookup_handle_cname function
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.
- Record
CVE-2026-24401- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
Show 22 moreShow less
OSVDEBIAN-CVE-2026-24401
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.
- Record
DEBIAN-CVE-2026-24401- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1450
avahi security update
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. This enables you to plug your laptop or computer into a network and instantly be able to view other people who you can chat with, find printers to print to or find files being shared.
Security Fix(es):
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524.(CVE-2026-24401)
- Record
OESA-2026-1450- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:11316
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:11316- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-24401
CVE-2026-24401 in avahi - Patched by Root
Root has patched CVE-2026-24401 in the avahi package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-24401- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-24401
CVE-2026-24401 in avahi - Patched by Root
Root has patched CVE-2026-24401 in the avahi package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-24401- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-24401
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.
- Record
UBUNTU-CVE-2026-24401- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-75204 No score
CVE-2026-24401 affecting package avahi for versions less than 0.8-5
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524.
- Record
AZL-75204- Updated
- 2026-11-02
OSVAZL-75207 No score
CVE-2026-24401 affecting package avahi for versions less than 0.8-7
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.
- Record
AZL-75207- Updated
- 2026-11-05
OSVCLSA-2026-1773137055 No score
avahi: Fix of CVE-2026-24401
- CVE-2026-24401: fix uncontrolled recursion in lookup_handle_cname caused by recursive CNAMEs
- Record
CLSA-2026-1773137055- Updated
- 2026-11-02
OSVCLSA-2026-1778112033 No score
avahi: Fix of CVE-2026-24401
- CVE-2026-24401: fix avahi-daemon crash on receipt of unsolicited mDNS responses containing self-referencing CNAME records by detecting CNAME loops in lookup_handle_cname() to prevent uncontrolled recursion and stack exhaustion; also includes two related DoS fixes in the same lookup path from upstream PR #682
- Record
CLSA-2026-1778112033- Updated
- 2026-11-02
OSVMGASA-2026-0338 No score
Updated avahi packages fix security vulnerabilities
Simple protocol server ignores accepts unlimited connections and logs
failures without limit. (CVE-2025-59529)
Avahi has Uncontrolled Recursion in lookup_handle_cname function.
(CVE-2026-24401)
Reachable assertion in transport_flags_from_domain() via conflicting
publish flags crashes avahi-daemon. (CVE-2026-34933)
- Record
MGASA-2026-0338- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10701-1 No score
avahi-0.8-44.1 on GA media
These are all security issues fixed in the avahi-0.8-44.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10701-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21014-1 No score
Security update for avahi
This update for avahi fixes the following issues:
- CVE-2026-34933: reachable assertion in
transport_flags_from_domaincan crash theavahi-daemon(bsc#1261546). - CVE-2026-24401: unsolicited mDNS responses containing a recursive CNAME record can crash the
avahi-daemon(bsc#1257235).
- Record
openSUSE-SU-2026:21014-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1191-1 No score
Security update for avahi
This update for avahi fixes the following issue:
- CVE-2026-24401: avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record (bsc#1257235).
- Record
SUSE-SU-2026:1191-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1441-1 No score
Security update for avahi
This update for avahi fixes the following issue:
- CVE-2026-24401: avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record (bsc#1257235).
- Record
SUSE-SU-2026:1441-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1442-1 No score
Security update for avahi
This update for avahi fixes the following issue:
- CVE-2026-24401: avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record (bsc#1257235).
- Record
SUSE-SU-2026:1442-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21117-1 No score
Security update for avahi
This update for avahi fixes the following issues:
- CVE-2026-24401: Fix unsolicited mDNS response containing a recursive CNAME record. (bsc#1257235)
- Record
SUSE-SU-2026:21117-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21127-1 No score
Security update for avahi
This update for avahi fixes the following issues:
- CVE-2026-24401: Fix unsolicited mDNS response containing a recursive CNAME record. (bsc#1257235)
- Record
SUSE-SU-2026:21127-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22258-1 No score
Security update for avahi
This update for avahi fixes the following issues:
- CVE-2026-34933: reachable assertion in
transport_flags_from_domaincan crash theavahi-daemon(bsc#1261546). - CVE-2026-24401: unsolicited mDNS responses containing a recursive CNAME record can crash the
avahi-daemon(bsc#1257235).
- Record
SUSE-SU-2026:22258-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22338-1 No score
Security update for avahi
This update for avahi fixes the following issues:
- CVE-2026-34933: reachable assertion in
transport_flags_from_domaincan crash theavahi-daemon(bsc#1261546). - CVE-2026-24401: unsolicited mDNS responses containing a recursive CNAME record can crash the
avahi-daemon(bsc#1257235).
- Record
SUSE-SU-2026:22338-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2311-1 No score
Security update for avahi
This update for avahi fixes the following issue:
- CVE-2026-24401: uncontrolled recursion in
lookup_handle_cnamecan crash theavahi-daemon(bsc#1257235). - CVE-2026-34933: reachable assertion in
transport_flags_from_domaincan crash theavahi-daemon(bsc#1261546).
- Record
SUSE-SU-2026:2311-1- Updated
- 2026-11-02
OSVUSN-8269-1 No score
avahi vulnerabilities
It is discovered that Avahi incorrectly handled crafted input. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-24401)
Guillaume Meunier discovered that Avahi incorrectly handled crafted input. An attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2026-34933)
- Record
USN-8269-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
avahiAlpine:v3.24 |
before 0.8-r25 | 0.8-r25 |
avahiAzure Linux:2 |
before 0.8-5 | 0.8-5 |
avahiAzure Linux:3 |
before 0.8-7 | 0.8-7 |
avahiAlpaquita:23 |
0.8-r5 up to 0.8-r9 | 0.8-r9 |
avahiAlpaquita:25 |
0.8-r20 up to 0.8-r22 | 0.8-r22 |
avahiAlpaquita:stream |
0.8-r5 up to 0.8-r24 | 0.8-r24 |
avahiTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-autoipdTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-compat-howlTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-compat-howl-develTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
Show 106 moreShow less
| Package | Affected | Fixed |
|---|---|---|
avahi-compat-libdns_sdTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-compat-libdns_sd-develTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-develTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-dnsconfdTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-glibTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-glib-develTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-gobjectTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-gobject-develTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-libsTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-toolsTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-uiTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-ui-develTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-ui-gtk3TuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahi-ui-toolsTuxCare:AlmaLinux:9.6 |
before 0.8-22.el9_6.1.tuxcare.els1 | 0.8-22.el9_6.1.tuxcare.els1 |
avahiTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-autoipdTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-compat-howlTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-compat-howl-develTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-compat-libdns_sdTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-compat-libdns_sd-develTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-develTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-dnsconfdTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-glibTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-glib-develTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-gobjectTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-gobject-develTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-libsTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-toolsTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-uiTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-ui-develTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-ui-gtk3TuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahi-ui-toolsTuxCare:AlmaLinux:9.2 |
before 0.8-12.el9_2.1.tuxcare.els4 | 0.8-12.el9_2.1.tuxcare.els4 |
avahiDebian:12 |
All versions, plus listed versions 0.8-100.8-10+deb12u10.8-110.8-120.8-13 Show 5 moreShow less0.8-140.8-150.8-160.8-170.8-18 |
None known |
avahiDebian:13 |
All versions, plus listed versions 0.8-160.8-170.8-18 |
None known |
avahiDebian:14 |
before 0.8-18, plus listed versions 0.8-160.8-17 |
0.8-18 |
avahiMageia:10 From an advisory covering 3 CVEs |
before 0.8-18.1.mga10 | 0.8-18.1.mga10 |
avahiMageia:9 From an advisory covering 3 CVEs |
before 0.8-10.4.mga9 | 0.8-10.4.mga9 |
avahiopenEuler:22.03-LTS-SP4 |
before 0.8-26.oe2203sp4 | 0.8-26.oe2203sp4 |
avahiopenEuler:24.03-LTS |
before 0.8-26.oe2403sp3 | 0.8-26.oe2403sp3 |
avahiopenEuler:24.03-LTS-SP1 |
before 0.8-26.oe2403sp1 | 0.8-26.oe2403sp1 |
avahiopenEuler:24.03-LTS-SP2 |
before 0.8-26.oe2403sp2 | 0.8-26.oe2403sp2 |
avahiopenEuler:24.03-LTS-SP3 |
before 0.8-26.oe2403sp3 | 0.8-26.oe2403sp3 |
avahiopenEuler:20.03-LTS-SP4 |
before 0.8-16.oe2003sp4 | 0.8-16.oe2003sp4 |
avahiRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-autoipdRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-compat-howlRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-compat-howl-develRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-compat-libdns_sdRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-compat-libdns_sd-develRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-develRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-dnsconfdRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-glibRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-glib-develRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-gobjectRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-gobject-develRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-libsRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-qt3Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-qt3-develRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-qt4Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-qt4-develRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-qt5Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-qt5-develRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-sharpRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-toolsRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-uiRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-ui-develRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-ui-gtk3Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-ui-sharpRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-ui-sharp-develRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahi-ui-toolsRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:0.9~rc4-0.1.hum1 | 0:0.9~rc4-0.1.hum1 |
avahiRoot:Debian:12 |
before 0.8-10+deb12u1.root.io.12 | 0.8-10+deb12u1.root.io.120.8-10+deb12u1.aikido.13 |
rootio-avahiRoot:Debian:12 |
before 0.8-10+deb12u1.root.io.12 | 0.8-10+deb12u1.root.io.120.8-10+deb12u1.aikido.13 |
avahiRoot:Debian:13 |
before 0.8-16.aikido.7 | 0.8-16.aikido.70.8-16.aikido.8 |
rootio-avahiRoot:Debian:13 |
before 0.8-16.aikido.7 | 0.8-16.aikido.70.8-16.aikido.8 |
avahiSUSE:Linux Enterprise Micro 5.2 |
before 0.7-150100.3.49.1 | 0.7-150100.3.49.1 |
avahiSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 0.8-150600.15.15.1 | 0.8-150600.15.15.1 |
avahi-glib2SUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 0.8-150600.15.15.1 | 0.8-150600.15.15.1 |
avahiSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 |
before 0.8-150600.15.15.1 | 0.8-150600.15.15.1 |
avahi-glib2SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 |
before 0.8-150600.15.15.1 | 0.8-150600.15.15.1 |
avahiSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 0.8-150600.15.15.1 | 0.8-150600.15.15.1 |
avahiopenSUSE:Leap 15.6 |
before 0.8-150600.15.15.1 | 0.8-150600.15.15.1 |
avahi-glib2openSUSE:Leap 15.6 |
before 0.8-150600.15.15.1 | 0.8-150600.15.15.1 |
avahi-qt5openSUSE:Leap 15.6 |
before 0.8-150600.15.15.1 | 0.8-150600.15.15.1 |
avahiSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 0.6.32-32.39.1 | 0.6.32-32.39.1 |
avahiSUSE:Linux Micro 6.1 |
before 0.8-slfo.1.1_5.1 | 0.8-slfo.1.1_5.1 |
avahiSUSE:Linux Micro 6.0 |
before 0.8-8.1 | 0.8-8.1 |
avahiSUSE:Linux Micro 6.2 From an advisory covering 2 CVEs |
before 0.8-160000.5.1 | 0.8-160000.5.1 |
avahiSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 0.8-160000.5.1 | 0.8-160000.5.1 |
avahi-glib2SUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 0.8-160000.5.1 | 0.8-160000.5.1 |
avahiSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 0.8-160000.5.1 | 0.8-160000.5.1 |
avahi-glib2SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 0.8-160000.5.1 | 0.8-160000.5.1 |
avahiSUSE:Linux Enterprise Micro 5.3 From an advisory covering 2 CVEs |
before 0.8-150400.7.31.2 | 0.8-150400.7.31.2 |
avahiSUSE:Linux Enterprise Micro 5.4 From an advisory covering 2 CVEs |
before 0.8-150400.7.31.2 | 0.8-150400.7.31.2 |
avahiSUSE:Linux Enterprise Micro 5.5 From an advisory covering 2 CVEs |
before 0.8-150400.7.31.2 | 0.8-150400.7.31.2 |
avahiUbuntu:Pro:14.04:LTS |
before 0.6.31-4ubuntu1.3+esm5, plus listed versions 0.6.31-2ubuntu40.6.31-2ubuntu50.6.31-3ubuntu10.6.31-4ubuntu10.6.31-4ubuntu1.1 Show 6 moreShow less0.6.31-4ubuntu1.20.6.31-4ubuntu1.30.6.31-4ubuntu1.3+esm10.6.31-4ubuntu1.3+esm20.6.31-4ubuntu1.3+esm30.6.31-4ubuntu1.3+esm4 |
0.6.31-4ubuntu1.3+esm5 |
avahiUbuntu:Pro:16.04:LTS |
before 0.6.32~rc+dfsg-1ubuntu2.3+esm5, plus listed versions 0.6.31-4ubuntu40.6.32~rc+dfsg-1ubuntu20.6.32~rc+dfsg-1ubuntu2.10.6.32~rc+dfsg-1ubuntu2.20.6.32~rc+dfsg-1ubuntu2.3 Show 4 moreShow less0.6.32~rc+dfsg-1ubuntu2.3+esm10.6.32~rc+dfsg-1ubuntu2.3+esm20.6.32~rc+dfsg-1ubuntu2.3+esm30.6.32~rc+dfsg-1ubuntu2.3+esm4 |
0.6.32~rc+dfsg-1ubuntu2.3+esm5 |
avahiUbuntu:Pro:18.04:LTS |
before 0.7-3.1ubuntu1.3+esm4, plus listed versions 0.6.32-1ubuntu10.7-3ubuntu10.7-3ubuntu20.7-3.1ubuntu10.7-3.1ubuntu1.1 Show 5 moreShow less0.7-3.1ubuntu1.20.7-3.1ubuntu1.30.7-3.1ubuntu1.3+esm10.7-3.1ubuntu1.3+esm20.7-3.1ubuntu1.3+esm3 |
0.7-3.1ubuntu1.3+esm4 |
avahiUbuntu:Pro:20.04:LTS |
before 0.7-4ubuntu7.3+esm2, plus listed versions 0.7-4ubuntu50.7-4ubuntu60.7-4ubuntu70.7-4ubuntu7.10.7-4ubuntu7.20.7-4ubuntu7.30.7-4ubuntu7.3+esm1 |
0.7-4ubuntu7.3+esm2 |
avahiUbuntu:22.04:LTS |
before 0.8-5ubuntu5.5, plus listed versions 0.8-5ubuntu40.8-5ubuntu50.8-5ubuntu5.10.8-5ubuntu5.20.8-5ubuntu5.30.8-5ubuntu5.4 |
0.8-5ubuntu5.5 |
avahiUbuntu:24.04:LTS |
before 0.8-13ubuntu6.2, plus listed versions 0.8-10ubuntu10.8-13ubuntu10.8-13ubuntu20.8-13ubuntu40.8-13ubuntu50.8-13ubuntu60.8-13ubuntu6.1 |
0.8-13ubuntu6.2 |
avahiUbuntu:25.10 |
before 0.8-16ubuntu3.2, plus listed versions 0.8-16ubuntu20.8-16ubuntu30.8-16ubuntu3.1 |
0.8-16ubuntu3.2 |
avahiUbuntu:26.04:LTS |
before 0.8-18ubuntu1.1, plus listed versions 0.8-16ubuntu30.8-17ubuntu10.8-17ubuntu20.8-18ubuntu1 |
0.8-18ubuntu1.1 |
avahiopenSUSE:Tumbleweed |
before 0.8-44.1 | 0.8-44.1 |
avahiopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 0.8-160000.5.1 | 0.8-160000.5.1 |
avahi-glib2openSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 0.8-160000.5.1 | 0.8-160000.5.1 |
avahi-qt6openSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 0.8-160000.5.1 | 0.8-160000.5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-24401 is a medium vulnerability (CVSS 6.5) in Avahi, published January 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in avahi 0.8-r25.
References
github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3
security.alpinelinux.org/vuln/CVE-2026-24401
nvd.nist.gov/vuln/detail/CVE-2026-24401
docs.bell-sw.com/security/cves/CVE-2026-24401
Show 61 moreShow less
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1773137055.html
security-tracker.debian.org/tracker/CVE-2026-24401
advisories.mageia.org/MGASA-2026-0338.html
bugs.mageia.org/show_bug.cgi?id=35044
openwall.com/lists/oss-security/2025/12/19/1
lists.opensuse.org/archives/list/[email protected]/message/LK4OWC4GTD6XELDD5SALQ5NAKJF2JEJ3
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1450
access.redhat.com/errata/RHSA-2026:11316
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11316.json
bugzilla.redhat.com/show_bug.cgi?id=2428713
cve.org/CVERecord?id=CVE-2025-68276
suse.com/support/update/announcement/2026/suse-su-20261191-1
bugzilla.suse.com/1257235
ubuntu.com/security/CVE-2026-24401