{"id":"CVE-2026-47183","aliases":["DEBIAN-CVE-2026-47183","EUVD-2026-45248","GHSA-phvx-9mgw-67r5","OESA-2026-3292","OESA-2026-3293","OESA-2026-3294","PYSEC-2026-3437","UBUNTU-CVE-2026-47183","openSUSE-SU-2026:21175-1"],"status":"published","title":"Zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion","description":"Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00389,"percentile":0.33253,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-05-29T20:13:08Z","modified":"2026-10-28T02:30:47Z","fixes":[{"ecosystem":"PyPI","package":"zeroconf","fixed_in":["0.149.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"python-zeroconf","fixed_in":["0.149.6-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.149.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.102.0-1","0.108.0-1","0.111.0-1","0.112.0-1","0.115.0-1","0.115.1-1","0.115.2-1","0.118.0-1","0.119.0-1","0.120.0-1","0.122.2-1","0.122.3-1","0.123.0-1","0.125.0-1","0.126.0-1","0.127.0-1","0.128.0-1","0.128.0-2","0.128.4-1","0.129.0-1","0.130.0-1","0.131.0-1","0.132.0-1","0.132.2-1","0.132.2-2","0.133.0-1","0.134.0-1","0.135.0-1","0.136.0-1","0.136.2-1","0.139.0-1","0.139.0-2","0.139.0-3","0.139.0-4","0.140.1-1","0.141.0-1","0.143.0-1","0.144.3-1","0.145.1-1","0.145.1-2","0.146.1-1","0.146.3-1","0.146.5-1","0.147.0-1","0.147.0-2","0.147.2-1","0.147.2-2","0.148.0-1","0.148.0-2","0.148.0-3","0.148.0-4","0.149.16-1","0.149.6-1","0.149.7-1","0.149.9-1","0.150.0-1","0.150.0-2","0.151.3-1","0.47.3-1","0.47.4-1","0.53.0-1","0.54.0-1","0.56.0-1","0.58.0-1","0.58.2-1","0.62.0-1","0.63.0-1","0.64.1-1","0.66.0-1","0.69.0-1","0.70.0-1","0.71.0-1","0.71.4-1","0.74.0-1","0.74.0-2","0.76.0-1","0.80.0-1","0.82.1-1","0.88.0-1","0.91.1-1","0.97.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.147.0-1","0.147.0-2","0.147.2-1","0.147.2-2","0.148.0-1","0.148.0-2","0.148.0-3","0.148.0-4","0.149.16-1","0.149.6-1","0.149.7-1","0.149.9-1","0.150.0-1","0.150.0-2","0.151.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.149.6-1"}]}],"versions":["0.147.0-1","0.147.0-2","0.147.2-1","0.147.2-2","0.148.0-1","0.148.0-2","0.148.0-3","0.148.0-4"]},{"source":"osv","ecosystem":"PyPI","package":"zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.149.6"}]}],"versions":["0.100.0","0.101.0","0.102.0","0.103.0","0.104.0","0.105.0","0.106.0","0.107.0","0.108.0","0.109.0","0.110.0","0.111.0","0.112.0","0.114.0","0.115.0","0.115.1","0.115.2","0.116.0","0.117.0","0.118.0","0.118.1","0.119.0","0.120.0","0.121.0","0.122.0","0.122.1","0.122.2","0.122.3","0.123.0","0.124.0","0.125.0","0.126.0","0.127.0","0.128.0","0.128.1","0.128.2","0.128.3","0.128.4","0.128.5","0.129.0","0.130.0","0.131.0","0.132.0","0.132.1","0.132.2","0.133.0","0.134.0","0.135.0","0.136.0","0.136.1","0.136.2","0.137.0","0.137.1","0.137.2","0.138.0","0.138.1","0.139.0","0.14","0.140.0","0.140.1","0.141.0","0.142.0","0.143.0","0.143.1","0.144.0","0.144.1","0.144.2","0.144.3","0.145.0","0.145.1","0.146.0","0.146.1","0.146.2","0.146.3","0.146.4","0.146.5","0.147.0","0.147.1","0.147.2","0.147.3","0.147.4","0.148.0","0.149.0","0.149.1","0.149.2","0.149.3","0.149.4","0.149.5","0.15","0.15.1","0.16.0","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.17.7","0.18.0","0.19.0","0.19.1","0.20.0","0.21.0","0.21.1","0.21.2","0.21.3","0.22.0","0.23.0","0.24.0","0.24.1","0.24.2","0.24.3","0.24.4","0.24.5","0.25.0","0.25.1","0.26.0","0.26.1","0.26.2","0.26.3","0.27.0","0.27.1","0.28.0","0.28.1","0.28.2","0.28.3","0.28.4","0.28.5","0.28.6","0.28.7","0.28.8","0.29.0","0.30.0","0.31.0","0.32.0","0.32.1","0.33.0","0.33.1","0.33.2","0.33.3","0.33.4","0.34.0","0.34.1","0.34.2","0.34.3","0.35.0","0.35.1","0.36.0","0.36.1","0.36.11","0.36.12","0.36.13","0.36.2","0.36.3","0.36.4","0.36.5","0.36.6","0.36.7","0.36.8","0.36.9","0.37.0","0.38.0","0.38.1","0.38.3","0.38.4","0.38.5","0.38.6","0.38.7","0.39.0","0.39.1","0.39.2","0.39.3","0.39.4","0.43.0","0.44.0","0.45.0","0.46.0","0.47.0","0.47.1","0.47.2","0.47.3","0.47.4","0.48.0","0.49.0","0.50.0","0.51.0","0.52.0","0.53.0","0.53.1","0.54.0","0.55.0","0.56.0","0.57.0","0.58.0","0.58.1","0.58.2","0.59.0","0.60.0","0.61.0","0.62.0","0.63.0","0.64.0","0.64.1","0.65.0","0.66.0","0.67.0","0.68.0","0.68.1","0.69.0","0.70.0","0.71.0","0.71.1","0.71.2","0.71.3","0.71.4","0.71.5","0.72.0","0.72.1","0.72.2","0.72.3","0.73.0","0.74.0","0.75.0","0.76.0","0.77.0","0.78.0","0.79.0","0.80.0","0.81.0","0.82.0","0.82.1","0.83.0","0.83.1","0.84.0","0.85.0","0.86.0","0.87.0","0.88.0","0.89.0","0.90.0","0.91.0","0.91.1","0.92.0","0.93.0","0.93.1","0.94.0","0.95.0","0.96.0","0.97.0","0.98.0","0.99.0"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.136.0-1.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.136.0-1.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.136.0-1.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.149.6"}]}],"versions":["0.100.0","0.101.0","0.102.0","0.103.0","0.104.0","0.105.0","0.106.0","0.107.0","0.108.0","0.109.0","0.110.0","0.111.0","0.112.0","0.114.0","0.115.0","0.115.1","0.115.2","0.116.0","0.117.0","0.118.0","0.118.1","0.119.0","0.120.0","0.121.0","0.122.0","0.122.1","0.122.2","0.122.3","0.123.0","0.124.0","0.125.0","0.126.0","0.127.0","0.128.0","0.128.1","0.128.2","0.128.3","0.128.4","0.128.5","0.129.0","0.130.0","0.131.0","0.132.0","0.132.1","0.132.2","0.133.0","0.134.0","0.135.0","0.136.0","0.136.1","0.136.2","0.137.0","0.137.1","0.137.2","0.138.0","0.138.1","0.139.0","0.14","0.140.0","0.140.1","0.141.0","0.142.0","0.143.0","0.143.1","0.144.0","0.144.1","0.144.2","0.144.3","0.145.0","0.145.1","0.146.0","0.146.1","0.146.2","0.146.3","0.146.4","0.146.5","0.147.0","0.147.1","0.147.2","0.147.3","0.147.4","0.148.0","0.149.0","0.149.1","0.149.2","0.149.3","0.149.4","0.149.5","0.15","0.15.1","0.16.0","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.17.7","0.18.0","0.19.0","0.19.1","0.20.0","0.21.0","0.21.1","0.21.2","0.21.3","0.22.0","0.23.0","0.24.0","0.24.1","0.24.2","0.24.3","0.24.4","0.24.5","0.25.0","0.25.1","0.26.0","0.26.1","0.26.2","0.26.3","0.27.0","0.27.1","0.28.0","0.28.1","0.28.2","0.28.3","0.28.4","0.28.5","0.28.6","0.28.7","0.28.8","0.29.0","0.30.0","0.31.0","0.32.0","0.32.1","0.33.0","0.33.1","0.33.2","0.33.3","0.33.4","0.34.0","0.34.1","0.34.2","0.34.3","0.35.0","0.35.1","0.36.0","0.36.1","0.36.11","0.36.12","0.36.13","0.36.2","0.36.3","0.36.4","0.36.5","0.36.6","0.36.7","0.36.8","0.36.9","0.37.0","0.38.0","0.38.1","0.38.3","0.38.4","0.38.5","0.38.6","0.38.7","0.39.0","0.39.1","0.39.2","0.39.3","0.39.4","0.43.0","0.44.0","0.45.0","0.46.0","0.47.0","0.47.1","0.47.2","0.47.3","0.47.4","0.48.0","0.49.0","0.50.0","0.51.0","0.52.0","0.53.0","0.53.1","0.54.0","0.55.0","0.56.0","0.57.0","0.58.0","0.58.1","0.58.2","0.59.0","0.60.0","0.61.0","0.62.0","0.63.0","0.64.0","0.64.1","0.65.0","0.66.0","0.67.0","0.68.0","0.68.1","0.69.0","0.70.0","0.71.0","0.71.1","0.71.2","0.71.3","0.71.4","0.71.5","0.72.0","0.72.1","0.72.2","0.72.3","0.73.0","0.74.0","0.75.0","0.76.0","0.77.0","0.78.0","0.79.0","0.80.0","0.81.0","0.82.0","0.82.1","0.83.0","0.83.1","0.84.0","0.85.0","0.86.0","0.87.0","0.88.0","0.89.0","0.90.0","0.91.0","0.91.1","0.92.0","0.93.0","0.93.1","0.94.0","0.95.0","0.96.0","0.97.0","0.98.0","0.99.0"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.2-1","0.17.4-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.3-1","0.23.0-1","0.24.4-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.1-1","0.36.11-1","0.36.12-1","0.36.13-1","0.37.0-1","0.38.1-1","0.38.3-1","0.38.3-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.76.0-1","0.119.0-1","0.126.0-1","0.127.0-1","0.128.0-1","0.128.0-2","0.128.4-1","0.129.0-1","0.130.0-1","0.131.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.147.0-1","0.148.0-1","0.148.0-2"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-zeroconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.136.0-bp160.2.1"}]}],"bundled":5}],"products":[{"vendor":"paulsm","product":"zeroconf"},{"vendor":"python-zeroconf","product":"python-zeroconf"}],"references":[{"url":"https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-phvx-9mgw-67r5","tags":["x_refsource_CONFIRM","Vendor Advisory","Patch","advisory","web","report"]},{"url":"https://github.com/python-zeroconf/python-zeroconf/issues/1714","tags":["x_refsource_MISC","Issue Tracking","Patch","report","web"]},{"url":"https://github.com/python-zeroconf/python-zeroconf/pull/1717","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/python-zeroconf/python-zeroconf/commit/95561e28b24922358f1991e38e3a86d70d72dcec","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.6","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/advisories/GHSA-phvx-9mgw-67r5","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47183.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47183","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-47183","tags":["advisory"]},{"url":"https://github.com/python-zeroconf/python-zeroconf","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48045","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3293","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3294","tags":["advisory"]},{"url":"https://pypi.org/project/zeroconf","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-47183","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47183","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268235","tags":["report"]},{"url":"https://bugzilla.suse.com/1268341","tags":["report"]},{"url":"https://bugzilla.suse.com/1268342","tags":["report"]},{"url":"https://bugzilla.suse.com/1268343","tags":["report"]},{"url":"https://bugzilla.suse.com/1268388","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48487","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-47183","title":"Zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion","description":"Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.","status":"published","published":"2026-07-17T18:22:59.803Z","modified":"2026-07-17T23:15:36.656Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-45248","description":"Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.","status":"published","published":"2026-07-17T18:22:59Z","modified":"2026-07-17T23:15:36Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:19:50.065723Z"}],"ghsa":[{"id":"GHSA-phvx-9mgw-67r5","title":"zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion","description":"### Impact\n`DNSIncoming._log_exception_debug` and the four `QuietLogger` exception-dedup methods stored an unbounded `_seen_logs` dict keyed by `str(sys.exc_info()[1])`. The seven `IncomingDecodeError` messages raised from `_read_name` / `_decode_labels_at_offset` (RFC 6762 §18 name-decoding error paths) all embed `self.source` — the peer's ephemeral source port, varying per packet — plus byte `offset` and pointer `link`, so every attacker-influenced combination produced a fresh dedup key. The stored value was the full `sys.exc_info()` triple, whose traceback's frame locals retained `self.data` (the raw inbound packet, up to 8966 bytes per RFC 6762 §17). Each unique malformed packet therefore pinned ~9 KB until process exit.\n\nAny unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can drive memory growth at line rate; that includes a guest on the same Wi-Fi, a compromised IoT device, or a container on a shared bridge. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardware is the canonical victim) sustained traffic trivially OOM-kills the process, and mDNS-dependent features (HomeKit, Chromecast/Matter, AirPlay, printers) degrade or fail.\n\n### Patches\nFixed in `zeroconf` 0.149.6 ([PR #1717](https://github.com/python-zeroconf/python-zeroconf/pull/1717)). Upgrade to `\u003e= 0.149.6`.\n\n### Workarounds\nThere is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP client isolation, guest-network separation, or host firewall rules.\n\n### Resources\n- [PR #1717](https://github.com/python-zeroconf/python-zeroconf/pull/1717), fix\n- [Issue #1714](https://github.com/python-zeroconf/python-zeroconf/issues/1714), public tracking issue\n- [RFC 6762 §17](https://www.rfc-editor.org/rfc/rfc6762#section-17), [RFC 6762 §18](https://www.rfc-editor.org/rfc/rfc6762#section-18), [CWE-400](https://cwe.mitre.org/data/definitions/400.html)","status":"published","published":"2026-05-29T20:13:08Z","modified":"2026-05-29T20:13:08Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:40:15.638885Z"}],"nvd":[{"id":"CVE-2026-47183","description":"Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.","status":"published","published":"2026-07-17T19:17:15.303Z","modified":"2026-08-17T19:50:03.17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-47183","title":"Zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion","description":"Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.","status":"published","published":"2026-07-17T18:22:59.803Z","modified":"2026-10-28T02:30:47.539166057Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:06.231145Z"},{"id":"DEBIAN-CVE-2026-47183","description":"Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.","status":"published","published":"2026-07-17T19:17:15.303Z","modified":"2026-10-01T03:03:24.245012407Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"GHSA-phvx-9mgw-67r5","title":"zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion","description":"### Impact\n`DNSIncoming._log_exception_debug` and the four `QuietLogger` exception-dedup methods stored an unbounded `_seen_logs` dict keyed by `str(sys.exc_info()[1])`. The seven `IncomingDecodeError` messages raised from `_read_name` / `_decode_labels_at_offset` (RFC 6762 §18 name-decoding error paths) all embed `self.source` — the peer's ephemeral source port, varying per packet — plus byte `offset` and pointer `link`, so every attacker-influenced combination produced a fresh dedup key. The stored value was the full `sys.exc_info()` triple, whose traceback's frame locals retained `self.data` (the raw inbound packet, up to 8966 bytes per RFC 6762 §17). Each unique malformed packet therefore pinned ~9 KB until process exit.\n\nAny unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can drive memory growth at line rate; that includes a guest on the same Wi-Fi, a compromised IoT device, or a container on a shared bridge. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardware is the canonical victim) sustained traffic trivially OOM-kills the process, and mDNS-dependent features (HomeKit, Chromecast/Matter, AirPlay, printers) degrade or fail.\n\n### Patches\nFixed in `zeroconf` 0.149.6 ([PR #1717](https://github.com/python-zeroconf/python-zeroconf/pull/1717)). Upgrade to `\u003e= 0.149.6`.\n\n### Workarounds\nThere is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP client isolation, guest-network separation, or host firewall rules.\n\n### Resources\n- [PR #1717](https://github.com/python-zeroconf/python-zeroconf/pull/1717), fix\n- [Issue #1714](https://github.com/python-zeroconf/python-zeroconf/issues/1714), public tracking issue\n- [RFC 6762 §17](https://www.rfc-editor.org/rfc/rfc6762#section-17), [RFC 6762 §18](https://www.rfc-editor.org/rfc/rfc6762#section-18), [CWE-400](https://cwe.mitre.org/data/definitions/400.html)","status":"published","published":"2026-05-29T20:13:08Z","modified":"2026-07-13T16:43:37.806701622Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"OESA-2026-3292","title":"python-zeroconf security update","description":"Pure Python Multicast DNS Service Discovery Library (Bonjour/Avahi compatible)\r\n\r\nSecurity Fix(es):\n\nZeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5.(CVE-2026-47180)\n\nZeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.(CVE-2026-47183)\n\nZeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, slower async_expire passes, and broken discovery, registration, and ServiceBrowser callbacks. This issue is fixed in version 0.149.7.(CVE-2026-47184)\n\nZeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12.(CVE-2026-48045)","status":"published","published":"2026-08-07T02:44:32Z","modified":"2026-08-07T03:00:56.806946717Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3293","title":"python-zeroconf security update","description":"Pure Python Multicast DNS Service Discovery Library (Bonjour/Avahi compatible)\r\n\r\nSecurity Fix(es):\n\nZeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5.(CVE-2026-47180)\n\nZeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.(CVE-2026-47183)\n\nZeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, slower async_expire passes, and broken discovery, registration, and ServiceBrowser callbacks. This issue is fixed in version 0.149.7.(CVE-2026-47184)\n\nZeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12.(CVE-2026-48045)","status":"published","published":"2026-08-07T02:44:34Z","modified":"2026-08-07T03:00:55.442533036Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3294","title":"python-zeroconf security update","description":"Pure Python Multicast DNS Service Discovery Library (Bonjour/Avahi compatible)\r\n\r\nSecurity Fix(es):\n\nZeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5.(CVE-2026-47180)\n\nZeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.(CVE-2026-47183)\n\nZeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, slower async_expire passes, and broken discovery, registration, and ServiceBrowser callbacks. This issue is fixed in version 0.149.7.(CVE-2026-47184)\n\nZeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12.(CVE-2026-48045)","status":"published","published":"2026-08-07T02:44:37Z","modified":"2026-08-07T03:00:55.654395772Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"PYSEC-2026-3437","title":"zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion","description":"### Impact\n`DNSIncoming._log_exception_debug` and the four `QuietLogger` exception-dedup methods stored an unbounded `_seen_logs` dict keyed by `str(sys.exc_info()[1])`. The seven `IncomingDecodeError` messages raised from `_read_name` / `_decode_labels_at_offset` (RFC 6762 §18 name-decoding error paths) all embed `self.source` — the peer's ephemeral source port, varying per packet — plus byte `offset` and pointer `link`, so every attacker-influenced combination produced a fresh dedup key. The stored value was the full `sys.exc_info()` triple, whose traceback's frame locals retained `self.data` (the raw inbound packet, up to 8966 bytes per RFC 6762 §17). Each unique malformed packet therefore pinned ~9 KB until process exit.\n\nAny unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can drive memory growth at line rate; that includes a guest on the same Wi-Fi, a compromised IoT device, or a container on a shared bridge. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardware is the canonical victim) sustained traffic trivially OOM-kills the process, and mDNS-dependent features (HomeKit, Chromecast/Matter, AirPlay, printers) degrade or fail.\n\n### Patches\nFixed in `zeroconf` 0.149.6 ([PR #1717](https://github.com/python-zeroconf/python-zeroconf/pull/1717)). Upgrade to `\u003e= 0.149.6`.\n\n### Workarounds\nThere is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP client isolation, guest-network separation, or host firewall rules.\n\n### Resources\n- [PR #1717](https://github.com/python-zeroconf/python-zeroconf/pull/1717), fix\n- [Issue #1714](https://github.com/python-zeroconf/python-zeroconf/issues/1714), public tracking issue\n- [RFC 6762 §17](https://www.rfc-editor.org/rfc/rfc6762#section-17), [RFC 6762 §18](https://www.rfc-editor.org/rfc/rfc6762#section-18), [CWE-400](https://cwe.mitre.org/data/definitions/400.html)","status":"published","published":"2026-07-13T15:19:14.609273Z","modified":"2026-07-13T16:32:47.255768774Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"UBUNTU-CVE-2026-47183","description":"Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.","status":"published","published":"2026-07-17T19:17:00Z","modified":"2026-07-29T10:18:35.142990383Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:30.797112Z"},{"id":"openSUSE-SU-2026:21175-1","title":"Security update for python-zeroconf","description":"This update for python-zeroconf fixes the following issues:\n\nChanges in python-zeroconf:\n\n- CVE-2026-47180: zeroconf has unbounded recursion in DNS\n  compression-pointer decoder that allows LAN-local denial of service\n  (bsc#1268341)\n- CVE-2026-47183: zeroconf: Unbounded exception-dedup state retains\n  packet buffers via traceback frame locals, enabling LAN-local memory\n  exhaustion (bsc#1268342)\n- CVE-2026-47184: zeroconf has unbounded DNS record cache that allows\n  LAN-local memory exhaustion via multicast flood (bsc#1268343)\n- CVE-2026-48045: python-zeroconf: Unbounded TC-deferred queue allows\n  LAN-local memory exhaustion via spoofed-source flood (bsc#1268388)\n- CVE-2026-48487: python-zeroconf: Unvalidated rdlength in record\n  payload readers allows LAN-local cache corruption via crafted mDNS\n  packet (bsc#1268235)\n","status":"published","published":"2026-06-30T09:08:26Z","modified":"2026-07-02T18:24:18.07432016Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}