CVE-2025-68468

Published: Jan 12, 2026Modified: Jan 16, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes.

Affected (2)

Products: Avahi: Avahi

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Avahi Avahi	Before 0.9
Avahi Avahi	Version 0.9 rc1

Related CWEs

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (3)

https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a

Source: security-advisories@github.com

Patch

https://github.com/avahi/avahi/issues/683

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.