CVE-2026-48487

Name
CVE-2026-48487
Description
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/python-zeroconf/python-zeroconf/commit/544449596e645fcaad3834fa0cb614a54f847a82
security-advisories@github.com https://github.com/python-zeroconf/python-zeroconf/issues/1752
security-advisories@github.com https://github.com/python-zeroconf/python-zeroconf/pull/1756
security-advisories@github.com https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.16
security-advisories@github.com https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:paulsm:zeroconf:*:*:*:*:*:python:*:* py3-zeroconf >= None < 0.149.16

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
py3-zeroconf edge-community 0.147.2-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
py3-zeroconf edge-community 0.147.2-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
py3-zeroconf edge-community 0.147.0-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
py3-zeroconf edge-community 0.147.0-r0 fossdd <fossdd@pwned.life> possibly vulnerable
py3-zeroconf edge-community 0.146.5-r0 fossdd <fossdd@pwned.life> possibly vulnerable
py3-zeroconf edge-community 0.146.3-r0 fossdd <fossdd@pwned.life> possibly vulnerable
py3-zeroconf edge-community 0.144.1-r0 fossdd <fossdd@pwned.life> possibly vulnerable
py3-zeroconf edge-community 0.132.2-r0 Fabian Affolter <fabian@affolter-engineering.ch> possibly vulnerable
py3-zeroconf 3.24-community 0.147.2-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable