CVE-2026-24401
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Jan 24, 2026
CISA due date
—
The record
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | avahi | 0 | 0.9_rc3-r0 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | avahi | 0 | 0.8-150600.15.15.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | avahi-glib2 | 0 | 0.8-150600.15.15.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | avahi | 0 | 0.8-150600.15.15.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | avahi-glib2 | 0 | 0.8-150600.15.15.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | avahi | 0 | 0.8-150600.15.15.1 |
| Wolfi | avahi | 0 | 0.9_rc3-r0 |
| openSUSE:Leap 15.6 | avahi | 0 | 0.8-150600.15.15.1 |
| openSUSE:Leap 15.6 | avahi-glib2 | 0 | 0.8-150600.15.15.1 |
| openSUSE:Leap 15.6 | avahi-qt5 | 0 | 0.8-150600.15.15.1 |
| openSUSE:Leap 16.0 | avahi | 0 | 0.8-160000.5.1 |
| openSUSE:Leap 16.0 | avahi-glib2 | 0 | 0.8-160000.5.1 |
| openSUSE:Leap 16.0 | avahi-qt6 | 0 | 0.8-160000.5.1 |
| openSUSE:Tumbleweed | avahi | 0 | 0.8-44.1 |
Related vulnerabilities
- CVE-2025-68468 Avahi is a system which facilitates service discovery on a local network via the… Also affects avahi
- CVE-2025-68471 Avahi is a system which facilitates service discovery on a local network via the… Also affects avahi
- CVE-2025-68276 Avahi is a system which facilitates service discovery on a local network via the… Also affects avahi
- CVE-2025-59529 simple protocol server ignores accepts unlimited connections and logs failures without… Also affects avahi
- CVE-2024-52615 A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS… Also affects avahi
- CVE-2024-52616 A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly… Also affects avahi
- CVE-2026-34933 Avahi is a system which facilitates service discovery on a local network via the… Also affects avahi
- CVE-2017-6519 avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast… Also affects avahi