Описание
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.
A flaw was found in Zeroconf, a Python library for multicast DNS service discovery. An unauthenticated attacker on the local network can exploit a vulnerability in how the system processes incoming DNS records. By sending a specially crafted record with an excessive length, the attacker can cause the system's DNS cache and service information to be populated with manipulated or truncated data. This could lead to incorrect service discovery or other data integrity issues within the affected system.
Отчет
Zeroconf is a pure Python implementation of multicast DNS (mDNS) service discovery. Prior to 0.149.16, the record string/character-string readers advance the parser offset using an attacker-declared RDLENGTH without checking it against the actual buffer length, allowing a malformed TXT, HINFO, or A/AAAA record to corrupt subsequent record parsing, resulting in data integrity impact for unauthenticated hosts on the local network segment (UDP/5353, 224.0.0.251 / ff02::fb). Exploitation requires the attacker to be on the same local link as the affected host, consistent with Red Hat's Adjacent (AV:A) attack vector scoring. This issue is fixed upstream in zeroconf 0.149.16. Red Hat's CVSS score matches the vendor/CVE.org assessment for this flaw. This flaw is one of a batch of related Zeroconf issues discovered and fixed close together (CVE-2026-47180, CVE-2026-47183, CVE-2026-47184, CVE-2026-48045, CVE-2026-48487); all affect the same Red Hat product streams in the same way and were triaged consistently as a batch.
Меры по смягчению последствий
Upgrade to zeroconf 0.149.16 or later once packaged in the affected Red Hat product. Where upgrading isn't immediately possible, restricting the affected host's exposure to the local network segment (network segmentation or firewalling multicast DNS traffic on UDP/5353) reduces the practical attack surface, since exploitation requires local-link access.
Ссылки на источники
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS3
Связанные уязвимости
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.
Zeroconf is a pure Python implementation of multicast DNS service disc ...
zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
EPSS
4.3 Medium
CVSS3