CVE-2026-47180 Details

A denial-of-service vulnerability has been identified in Zeroconf, a Python implementation of multicast DNS service discovery, in versions prior to 0.149.5. The issue arises in the DNSIncoming class, where the label decoding function can be tricked into excessive recursion by a malicious mDNS packet. This unbounded recursion leads to a RecursionError that escapes the constructor, causing high CPU usage, log flooding, and disruption of mDNS-dependent features for unauthenticated hosts on the local network over UDP port 5353.

Users are advised to upgrade to Zeroconf version 0.149.5 or later. If an upgrade is not possible, mDNS traffic can be restricted to trusted Layer-2 segments using AP client isolation, guest-network separation, or host firewall rules.