CVE-2026-47180

Name of the Vulnerable Software and Affected Versions zeroconf versions prior to 0.149.5

Description An unauthenticated host on the local link can degrade the mDNS listener by sending a specially crafted mDNS packet. The DNSIncoming. decode labels at offset function recurses for each DNS-name compression pointer, but it does not cap the chain length of unique forward pointers. A packet of approximately 3 kB containing about 1500 chained pointers can exceed CPython's default recursion limit, triggering a RecursionError. Because this error was not handled in DECODE EXCEPTIONS, it escapes DNSIncoming. init and is processed by the asyncio default exception handler. This can lead to sustained CPU consumption, log flooding, and the degradation of mDNS-dependent features such as HomeKit, AirPlay, and Chromecast/Matter.

Recommendations Upgrade to version 0.149.5 or later. Restrict mDNS (UDP/5353) to trusted Layer-2 segments using host firewall rules, guest-network separation, or AP client isolation.