CVE-2026-48045 Details
Description
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12.
A denial-of-service vulnerability has been identified in Zeroconf, a Python implementation of multicast DNS service discovery, in versions prior to 0.149.12. The issue arises in the AsyncListener.handle_query_or_defer method, which improperly manages truncated incoming queries by retaining them in a per-address deferred queue. This unbounded queue allows unauthenticated hosts on the local link to flood the service with spoofed-source queries, leading to memory exhaustion and increased CPU usage. The vulnerability is particularly impactful on resource-constrained devices, such as those running Home Assistant on Raspberry Pi.
Users should upgrade to Zeroconf version 0.149.12 or later. For those unable to upgrade, it is recommended to restrict mDNS traffic to trusted local segments using network isolation techniques or host firewall rules.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| paulsm zeroconf | < 0.149.12 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | Initial Analysis | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |