CVE-2025-68276
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Jan 12, 2026
CISA due date
—
The record
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | avahi | 0 | 0.9_rc2-r1 |
| Chainguard | avahi-dev | 0 | 0.9_rc3-r0 |
| Mageia:9 | avahi | 0 | 0.8-10.3.mga9 |
| SUSE:Linux Enterprise Micro 5.3 | avahi | 0 | 0.8-150400.7.26.1 |
| SUSE:Linux Enterprise Micro 5.4 | avahi | 0 | 0.8-150400.7.26.1 |
| SUSE:Linux Enterprise Micro 5.5 | avahi | 0 | 0.8-150400.7.26.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | avahi | 0 | 0.8-150600.15.12.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | avahi-glib2 | 0 | 0.8-150600.15.12.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | avahi | 0 | 0.8-150600.15.12.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | avahi-glib2 | 0 | 0.8-150600.15.12.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | avahi | 0 | 0.8-150600.15.12.1 |
| Wolfi | avahi | 0 | 0.9_rc2-r1 |
| Wolfi | avahi-dev | 0 | 0.9_rc3-r0 |
| openSUSE:Leap 15.6 | avahi | 0 | 0.8-150600.15.12.1 |
| openSUSE:Leap 15.6 | avahi-glib2 | 0 | 0.8-150600.15.12.1 |
| openSUSE:Leap 15.6 | avahi-qt5 | 0 | 0.8-150600.15.12.1 |
| openSUSE:Leap 16.0 | avahi | 0 | 0.8-160000.4.1 |
| openSUSE:Leap 16.0 | avahi-glib2 | 0 | 0.8-160000.4.1 |
| openSUSE:Leap 16.0 | avahi-qt6 | 0 | 0.8-160000.4.1 |
| openSUSE:Tumbleweed | avahi | 0 | 0.8-41.1 |
Related vulnerabilities
- CVE-2026-24401 Avahi is a system which facilitates service discovery on a local network via the… Also affects avahi
- CVE-2025-68468 Avahi is a system which facilitates service discovery on a local network via the… Also affects avahi
- CVE-2025-68471 Avahi is a system which facilitates service discovery on a local network via the… Also affects avahi
- CVE-2025-59529 simple protocol server ignores accepts unlimited connections and logs failures without… Also affects avahi
- CVE-2024-52616 A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly… Also affects avahi
- CVE-2024-52615 A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS… Also affects avahi
- CVE-2026-34933 Avahi is a system which facilitates service discovery on a local network via the… Also affects avahi
- CVE-2017-6519 avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast… Also affects avahi