CVE-2026-47184

Name of the Vulnerable Software and Affected Versions zeroconf versions prior to 0.149.6

Description An unauthenticated host on the local link can send multicast mDNS responses with unique names to the DNSCache. async add function, causing records to accumulate in cache, expirations, expire heap, and service cache without a cap on the entry count. This can lead to an Out-of-Memory (OOM) condition that kills the process on memory-constrained hardware. Additionally, a high volume of records can slow down cache lookups and periodic expiry passes, starving the asyncio event loop and disrupting discovery, registration, and ServiceBrowser callbacks. A second variant involves re-multicasting cached records with shifting TTLs, which causes the expire heap to grow unbounded between cleanup runs.

Recommendations Upgrade to version 0.149.6 or later. Restrict mDNS traffic on UDP port 5353 to trusted Layer-2 segments using host firewall rules, guest-network separation, or AP client isolation.