CVE-2026-47184 Details

A denial-of-service vulnerability has been identified in Zeroconf, a Python implementation of multicast DNS service discovery, in versions prior to 0.149.7. The issue arises in the DNSCache component, where the method '_async_add' improperly handles response records. It inserts every record into the cache, expiration tracking, and service cache without any limit. This flaw allows unauthenticated hosts on the local network to flood the service with valid mDNS responses, causing significant memory exhaustion. The vulnerability disrupts normal operations by slowing down cache lookups and expiration processes, ultimately breaking related discovery and registration functions.

Users are advised to upgrade to Zeroconf version 0.149.7 or later, where this vulnerability has been fixed. For those unable to upgrade, it is recommended to restrict mDNS traffic to trusted local network segments using network isolation techniques or host-based firewall rules.