CVE-2026-47183
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Jul 17, 2026
CISA due date
—
The record
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | python-zeroconf | 0 | 0.136.0-bp160.2.1 |
Related vulnerabilities
- CVE-2026-47180 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-47184 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-48487 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-48045 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-116668 Tanium addressed an uncontrolled resource consumption vulnerability in Discover. CWE-400
- CVE-2026-111751 Angular is a development platform for building mobile and desktop web applications using… CWE-400
- CVE-2026-111752 Angular is a development platform for building mobile and desktop web applications using… CWE-400
- CVE-2026-63476 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-400