CVE-2026-47183 Details
Description
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.
A denial-of-service vulnerability has been identified in Zeroconf, a Python implementation of multicast DNS service discovery, prior to version 0.149.6. The issue arises in the DNSIncoming._log_exception_debug method and four QuietLogger exception-deduplication methods, which maintain an unbounded dictionary of seen logs. This dictionary is keyed by attacker-influenced IncomingDecodeError messages, and the values are full exception tracebacks. The retained tracebacks include raw packet data buffers, creating a memory leak. This vulnerability allows unauthenticated hosts on the local link to send malicious packets that are processed by the mDNS parser, leading to excessive memory usage. Over time, this can cause the process to be killed by the operating system due to out-of-memory conditions, degrading or disrupting mDNS-dependent features.
Users can upgrade to Zeroconf version 0.149.6 or later, where this vulnerability is fixed. For those unable to upgrade, it is recommended to restrict mDNS traffic to trusted local segments.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| paulsm zeroconf | < 0.149.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | Initial Analysis | [email protected] |
| Jul 18, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |