CVE-2026-47184
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Jul 17, 2026
CISA due date
—
The record
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, slower async_expire passes, and broken discovery, registration, and ServiceBrowser callbacks. This issue is fixed in version 0.149.7.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | python-zeroconf | 0 | 0.136.0-bp160.2.1 |
Related vulnerabilities
- CVE-2026-47183 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-47180 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-48487 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-48045 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-116646 Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response. CWE-770
- CVE-2026-111751 Angular is a development platform for building mobile and desktop web applications using… CWE-770
- CVE-2026-63501 ag-psd is a JavaScript library for reading and writing Photoshop Document files. CWE-770
- CVE-2026-115715 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead… CWE-770