CVE-2026-24401 Details
Description
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524.
A denial-of-service vulnerability has been identified in Avahi versions through 0.9rc2. The issue arises in avahi-daemon, which can be crashed by sending an unsolicited mDNS response containing a recursive CNAME record that points to the same domain. This creates unbounded recursion in the 'lookup_handle_cname' function, causing a segmentation fault and stack exhaustion. The vulnerability specifically impacts record browsers that have 'AVAHI_LOOKUP_USE_MULTICAST' enabled, including those created by resolvers used with nss-mdns.
Users can update to Avahi version 0.9 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524 | [email protected] | Patch |
| https://github.com/avahi/avahi/issues/501 | [email protected] | Issue TrackingPatch |
| https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| avahi avahi | < 0.9 0.9 rc1 0.9 rc2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 12, 2026 | Initial Analysis | [email protected] |
| Jan 24, 2026 | New CVE Received | [email protected] |