CVE-2026-48487
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
Jul 17, 2026
CISA due date
—
The record
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | python-zeroconf | 0 | 0.136.0-bp160.2.1 |
| openSUSE:Tumbleweed | python-zeroconf | 0 | 0.149.16-1.1 |
Related vulnerabilities
- CVE-2026-48045 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-47183 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-47180 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-47184 Zeroconf is a pure Python implementation of multicast DNS service discovery. Also affects python-zeroconf
- CVE-2026-15418 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged… CWE-130
- CVE-2026-5706 In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger… CWE-130
- CVE-2026-71402 An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. CWE-130
- CVE-2026-81575 If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts… CWE-130