https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T16:28:26.684487+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-airshare-cve-2026-47183 BREW-airshare-CVE-2026-47183 — zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory… 2026-10-06T16:28:26.752347+00:00

Affected: Homebrew: airshare

### Impact `DNSIncoming._log_exception_debug` and the four `QuietLogger` exception-dedup methods stored an unbounded `_seen_logs` dict keyed by `str(sys.exc_info()[1])`. The seven `IncomingDecodeError` messages raised from `_read_name` / `_decode_labels_at_offset` (RFC 6762 §18 name-decoding error paths) all embed `self.source` — the peer's ephemeral source port, varying per packet — plus byte `offset` and pointer `link`, so every attacker-influenced combination produced a fresh dedup key. The stored value was the full `sys.exc_info()` triple, whose traceback's frame locals retained `self.data` (the raw inbound packet, up to 8966 bytes per RFC 6762 §17). Each unique malformed packet therefore pinned ~9 KB until process exit.

Any unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can drive memory growth at line rate; that includes a guest on the same Wi-Fi, a compromised IoT device, or a container on a shared bridge. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardware is the canonical victim) sustained traffic trivially OOM-kills the process, and mDNS-dependent features (HomeKit, Chromecast/Matter, AirPlay, printers) degrade or fail.

### Patches Fixed in `zeroconf` 0.149.6 ([PR #1717](https://github.com/python-zeroconf/python-zeroconf/pull/1717)). Upgrade to `>= 0.149.6`.

### Workarounds There is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP clie…

 https://cve.radiocsirt.org/vuln/euvd-2026-338597 EUVD-2026-338597 2026-10-06T16:28:26.752431+00:00 EUVD-2026-338597 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47183 fkie_cve-2026-47183 2026-10-06T16:28:26.752448+00:00

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.

 https://cve.radiocsirt.org/vuln/ghsa-phvx-9mgw-67r5 GHSA-phvx-9mgw-67r5 — zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory… 2026-10-06T16:28:26.752475+00:00

Affected: PyPI: zeroconf

### Impact `DNSIncoming._log_exception_debug` and the four `QuietLogger` exception-dedup methods stored an unbounded `_seen_logs` dict keyed by `str(sys.exc_info()[1])`. The seven `IncomingDecodeError` messages raised from `_read_name` / `_decode_labels_at_offset` (RFC 6762 §18 name-decoding error paths) all embed `self.source` — the peer's ephemeral source port, varying per packet — plus byte `offset` and pointer `link`, so every attacker-influenced combination produced a fresh dedup key. The stored value was the full `sys.exc_info()` triple, whose traceback's frame locals retained `self.data` (the raw inbound packet, up to 8966 bytes per RFC 6762 §17). Each unique malformed packet therefore pinned ~9 KB until process exit.

Any unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can drive memory growth at line rate; that includes a guest on the same Wi-Fi, a compromised IoT device, or a container on a shared bridge. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardware is the canonical victim) sustained traffic trivially OOM-kills the process, and mDNS-dependent features (HomeKit, Chromecast/Matter, AirPlay, printers) degrade or fail.

### Patches Fixed in `zeroconf` 0.149.6 ([PR #1717](https://github.com/python-zeroconf/python-zeroconf/pull/1717)). Upgrade to `>= 0.149.6`.

### Workarounds There is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP clie…

 https://cve.radiocsirt.org/vuln/oesa-2026-3292 OESA-2026-3292 — python-zeroconf security update 2026-10-06T16:28:26.752515+00:00

Affected: openEuler:24.03-LTS-SP3: python-zeroconf

Pure Python Multicast DNS Service Discovery Library (Bonjour/Avahi compatible) Security Fix(es):

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5.(CVE-2026-47180)

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.(CVE-2026-47183)

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache without a cap, allowing unauthenticated hosts on the local link over UDP…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21175-1 openSUSE-SU-2026:21175-1 — Security update for python-zeroconf 2026-10-06T16:28:26.752553+00:00

Security update for python-zeroconf

 https://cve.radiocsirt.org/vuln/pysec-2026-3437 PYSEC-2026-3437 — zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory… 2026-10-06T16:28:26.752572+00:00

Affected: PyPI: zeroconf

### Impact `DNSIncoming._log_exception_debug` and the four `QuietLogger` exception-dedup methods stored an unbounded `_seen_logs` dict keyed by `str(sys.exc_info()[1])`. The seven `IncomingDecodeError` messages raised from `_read_name` / `_decode_labels_at_offset` (RFC 6762 §18 name-decoding error paths) all embed `self.source` — the peer's ephemeral source port, varying per packet — plus byte `offset` and pointer `link`, so every attacker-influenced combination produced a fresh dedup key. The stored value was the full `sys.exc_info()` triple, whose traceback's frame locals retained `self.data` (the raw inbound packet, up to 8966 bytes per RFC 6762 §17). Each unique malformed packet therefore pinned ~9 KB until process exit.

Any unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can drive memory growth at line rate; that includes a guest on the same Wi-Fi, a compromised IoT device, or a container on a shared bridge. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardware is the canonical victim) sustained traffic trivially OOM-kills the process, and mDNS-dependent features (HomeKit, Chromecast/Matter, AirPlay, printers) degrade or fail.

### Patches Fixed in `zeroconf` 0.149.6 ([PR #1717](https://github.com/python-zeroconf/python-zeroconf/pull/1717)). Upgrade to `>= 0.149.6`.

### Workarounds There is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP clie…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-47183 UBUNTU-CVE-2026-47183 2026-10-06T16:28:26.752608+00:00

Affected: Ubuntu:16.04:LTS: python-zeroconf, Ubuntu:18.04:LTS: python-zeroconf, Ubuntu:20.04:LTS: python-zeroconf, Ubuntu:22.04:LTS: python-zeroconf, Ubuntu:24.04:LTS: python-zeroconf, Ubuntu:26.04:LTS: python-zeroconf

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.