CVE-2026-47180

Published: Jul 17, 2026Modified: Aug 17, 2026

6.5

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5.

Affected (1)

Products: Paulsm: Zeroconf

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Paulsm Zeroconf	Before 0.149.5

Related CWEs

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (4)

https://github.com/python-zeroconf/python-zeroconf/commit/f9e23592137f30fdf7ef710dba065da31c79b1cf

Source: security-advisories@github.com

Patch

https://github.com/python-zeroconf/python-zeroconf/pull/1719

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.5

Source: security-advisories@github.com

Release Notes

https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9pgc-3ccv-5297

Source: security-advisories@github.com

Vendor AdvisoryPatch

Timeline

No history available yet.