{"id":"CVE-2021-3502","aliases":["ALPINE-CVE-2021-3502","ALSA-2023:6707","AZL-40943","BELL-CVE-2021-3502","CLSA-2025-1743675732","DEBIAN-CVE-2021-3502","EUVD-2021-26822","GHSA-mw7q-3wxj-rqfx","MGASA-2021-0339","RHSA-2023:6707","UBUNTU-CVE-2021-3502","USN-5008-1","openSUSE-SU-2024:10643-1"],"status":"published","title":"A flaw was found in avahi 0.8-5. A reachable assertion is present in...","description":"A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00374,"percentile":0.31577,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476","CWE-617"],"published":"2021-05-07T11:46:21Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"avahi","fixed_in":["0.8-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"avahi","fixed_in":["0.8-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"avahi","fixed_in":["0.8-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"avahi","fixed_in":["0.8-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"avahi","fixed_in":["0.8-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"avahi","fixed_in":["0.8-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"avahi","fixed_in":["0.8-r5"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"avahi","fixed_in":["0.8-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"avahi","fixed_in":["0.8-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"avahi","fixed_in":["0.8-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"avahi","fixed_in":["0.8-6"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"avahi","fixed_in":["0.8-6.2.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"avahi","fixed_in":["0.8-5ubuntu4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-r5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"avahi-compat-howl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"avahi-compat-howl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"avahi-compat-libdns_sd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"avahi-compat-libdns_sd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"avahi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"avahi-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"avahi-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"avahi-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"avahi-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-autoipd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-compat-howl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-compat-howl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-compat-libdns_sd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-compat-libdns_sd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-dnsconfd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-gobject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-gobject-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-ui-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-ui-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"avahi-ui-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-12.el9_2.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-6"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-6.2.mga8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-autoipd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-compat-howl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-compat-libdns_sd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-dnsconfd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-glib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-gobject-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-ui-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-ui-gtk3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"avahi-ui-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-autoipd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-compat-howl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-compat-libdns_sd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-dnsconfd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-glib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-gobject-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-ui-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-ui-gtk3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"avahi-ui-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-autoipd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-compat-howl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-compat-howl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-compat-howl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-compat-libdns_sd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-compat-libdns_sd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-compat-libdns_sd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-dnsconfd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-glib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-gobject-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-ui-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-ui-gtk3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"avahi-ui-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8-15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-5ubuntu4"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3"}]}],"versions":["0.6.32-1ubuntu1","0.7-3ubuntu1","0.7-3ubuntu2","0.7-3.1ubuntu1","0.7-3.1ubuntu1.1","0.7-3.1ubuntu1.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-4ubuntu7.1"}]}],"versions":["0.7-4ubuntu5","0.7-4ubuntu6","0.7-4ubuntu7"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-7.2"}]}],"bundled":8}],"products":[{"vendor":"avahi","product":"avahi"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1946914","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/lathiat/avahi/issues/338","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3502","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mw7q-3wxj-rqfx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-3502","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6707","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3468","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3502","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1981","tags":["report"]},{"url":"https://bugzilla.redhat.com/1939614","tags":["report"]},{"url":"https://bugzilla.redhat.com/1946914","tags":["report"]},{"url":"https://bugzilla.redhat.com/2185911","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6707.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-3502","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1743675732.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3502","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0339.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29239","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5008-1","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1939614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2185911","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6707.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3468","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3468","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3502","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1981","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3502","tags":["report"]},{"url":"https://github.com/lathiat/avahi/pull/324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3468","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3502","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3502","description":"A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.","status":"published","published":"2021-05-07T11:46:21Z","modified":"2024-08-03T16:53:17.966Z","cwes":["CWE-617"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26822","description":"A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.","status":"published","published":"2021-05-07T11:46:21Z","modified":"2024-08-03T16:53:17Z","updated_at":"2026-11-03T03:25:13.052236Z"}],"ghsa":[{"id":"GHSA-mw7q-3wxj-rqfx","title":"A flaw was found in avahi 0.8-5. A reachable assertion is present in...","description":"A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.","status":"published","published":"2022-05-24T19:01:47Z","modified":"2023-01-29T05:06:39Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:46:04.414181Z"}],"nvd":[{"id":"CVE-2021-3502","description":"A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.","status":"published","published":"2021-05-07T12:15:07.267Z","modified":"2026-06-17T04:05:14.577Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:06:52.81233Z"}],"osv":[{"id":"ALPINE-CVE-2021-3502","description":"A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.","status":"published","published":"2021-05-07T12:15:07.267Z","modified":"2026-10-23T17:17:56.195899545Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-40943","title":"CVE-2021-3502 affecting package avahi for versions less than 0.8-1","description":"A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.","status":"published","published":"2021-05-07T12:15:07Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"BELL-CVE-2021-3502","title":"CVE-2021-3502 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:08.128036Z","modified":"2026-01-26T09:47:03.167144Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-3502","description":"A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.","status":"published","published":"2021-05-07T12:15:07.267Z","modified":"2026-04-16T04:30:42.024301359Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-3502","description":"A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.","status":"published","published":"2021-05-07T12:15:07.267Z","modified":"2026-10-23T18:03:37.769253254Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"RHSA-2023:6707","title":"Red Hat Security Advisory: avahi security update","status":"published","published":"2024-09-16T13:09:00Z","modified":"2026-06-27T10:18:35Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"UBUNTU-CVE-2021-3502","description":"A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.","status":"published","published":"2021-05-07T12:15:00Z","modified":"2026-04-22T12:55:44.695599Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"ALSA-2023:6707","title":"Moderate: avahi security update","description":"Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers.\n\nSecurity Fix(es):\n\n* avahi: Local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket (CVE-2021-3468)\n* avahi: reachable assertion in avahi_s_host_name_resolver_start when trying to resolve badly-formatted hostnames (CVE-2021-3502)\n* avahi: avahi-daemon can be crashed via DBus (CVE-2023-1981)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:36.007406957Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2025-1743675732","title":"avahi: Fix of 8 CVEs","description":"- CVE-2021-3468: handle termination event on avahi Unix socket to prevent\n  infinite loop\n- CVE-2023-1981: prevent avahi daemon crash by emitting an error if the requested D-Bus\n  service is not found\n- CVE-2021-3502: fix avahi-daemon crashing from NULL pointer assertions\n- CVE-2023-38469: reject overly long TXT resource records to prevent reachable assertion\n  in avahi_dns_packet_append_record\n- CVE-2023-38470: ensure each label is at least one byte long in avahi_normalize_name()\n  to prevent reachable assertion in avahi_escape_label()\n- CVE-2023-38471: fix creating invalid escape sequence in dbus_set_host_name function\n- CVE-2023-38472: ensure avahi_rdata_parse() has valid rdata before parsing to prevent\n  reachable assertion\n- CVE-2023-38473: normalize input in avahi_alternative_host_name() to prevent\n  reachable assertion due to unescaped dot handling","status":"published","published":"2025-04-03T10:22:18Z","modified":"2026-10-21T10:45:08.537312853Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"MGASA-2021-0339","title":"Updated avahi packages fix a security vulnerability","description":"A flaw was found in avahi 0.8-5. A reachable assertion is present in\navahi_s_host_name_resolver_start function allowing a local attacker to crash\nthe avahi service by requesting hostname resolutions through the avahi socket\nor dbus methods for invalid hostnames. The highest threat from this\nvulnerability is to the service availability (CVE-2021-3502).\n","status":"published","published":"2021-07-10T20:00:34Z","modified":"2026-04-16T04:43:06.686014074Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:10643-1","title":"avahi-0.8-7.2 on GA media","description":"These are all security issues fixed in the avahi-0.8-7.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:49:33.342861Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-5008-1","title":"avahi vulnerabilities","description":"Thomas Kremer discovered that Avahi incorrectly handled termination signals\non the Unix socket. A local attacker could possibly use this issue to cause\nAvahi to hang, resulting in a denial of service. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-3468)\n\nIt was discovered that Avahi incorrectly handled certain hostnames. A local\nattacker could possibly use this issue to cause Avahi to crash, resulting\nin a denial of service. This issue only affected Ubuntu 20.10 and Ubuntu\n21.04. (CVE-2021-3502)\n","status":"published","published":"2021-07-07T17:19:33Z","modified":"2026-04-22T10:15:57.763033Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}