CVE-2026-47180
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Jul 17, 2026
CISA due date
—
The record
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | python-zeroconf | 0 | 0.136.0-bp160.2.1 |
Related vulnerabilities
- CVE-2026-47183 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-47184 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-48487 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-48045 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-121092 Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-674
- CVE-2026-63475 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-674
- CVE-2026-115290 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via… CWE-674
- CVE-2026-121423 SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows… CWE-674