CVE-2026-48487
Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.
| CWE | CWE-130 |
| Vendor | python-zeroconf |
| Product | python-zeroconf |
| Published | Jul 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for python-zeroconf python-zeroconf
Be the first to know when new unknown vulnerabilities affecting python-zeroconf python-zeroconf are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
python-zeroconf / python-zeroconf
< 0.149.16
References
github.com: https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9 github.com: https://github.com/python-zeroconf/python-zeroconf/issues/1752 github.com: https://github.com/python-zeroconf/python-zeroconf/pull/1756 github.com: https://github.com/python-zeroconf/python-zeroconf/commit/544449596e645fcaad3834fa0cb614a54f847a82 github.com: https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.16