CVE-2026-48045

Name of the Vulnerable Software and Affected Versions Zeroconf versions prior to 0.149.12

Description An issue exists in the AsyncListener.handle query or defer() function where the software retains every truncated TC-bit incoming query in self. deferred[addr] and arms a per-address timer in self. timers[addr]. Because there is no cap on the per-address list or the number of distinct addr keys, an unauthenticated host on the local link via UDP/5353 can send byte-distinct TC-flagged mDNS queries, each up to MAX MSG ABSOLUTE (8966 bytes). By spoofing source IPs, an attacker can cause the deferred and timers structures to grow, leading to memory exhaustion and quadratic CPU consumption due to an O(N) deduplication check. On memory-constrained hardware, this can result in the process being killed by the operating system (OOM-kill), while lighter loads may cause event-loop scheduler starvation, disrupting discovery, registration, and ServiceBrowser callbacks.

Recommendations Update to version 0.149.12 or later. Restrict mDNS (UDP/5353) traffic to trusted Layer-2 segments using host firewall rules, guest-network separation, or AP client isolation.