https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 22:28:51 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-03596 bdu:2026-03596 https://cve.radiocsirt.org/vuln/bdu:2026-03596 https://cve.radiocsirt.org/vuln/bell-cve-2025-59529 <p><strong>Affected:</strong> Alpaquita:23: avahi, Alpaquita:25: avahi, Alpaquita:stream: avahi</p> <p><strong>Affected:</strong> Alpaquita:23: avahi, Alpaquita:25: avahi, Alpaquita:stream: avahi</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-59529 https://cve.radiocsirt.org/vuln/euvd-2026-264209 EUVD-2026-264209 https://cve.radiocsirt.org/vuln/euvd-2026-264209 https://cve.radiocsirt.org/vuln/fkie_cve-2025-59529 <p>Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-dae…</p> <p>Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-dae…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-59529 https://cve.radiocsirt.org/vuln/msrc_cve-2025-59529 msrc_CVE-2025-59529 https://cve.radiocsirt.org/vuln/msrc_cve-2025-59529 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11313-1 <p>avahi-0.8-45.1 on GA media</p> <p>avahi-0.8-45.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11313-1 https://cve.radiocsirt.org/vuln/rhsa-2026:7411 <p>avahi: simple clients denial-of-service</p> <p>avahi: simple clients denial-of-service</p> https://cve.radiocsirt.org/vuln/rhsa-2026:7411 https://cve.radiocsirt.org/vuln/suse-su-2026:22853-1 <p>Security update for avahi</p> <p>Security update for avahi</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22853-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-59529 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: avahi, Ubuntu:Pro:16.04:LTS: avahi, Ubuntu:Pro:18.04:LTS: avahi, Ubuntu:Pro:20.04:LTS: avahi, Ubuntu:22.04:LTS: avahi, Ubuntu:24.04:LTS: avahi, Ubuntu:25.10: avahi, Ubuntu:26.04:LTS: avahi</p> <p>Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-dae…</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: avahi, Ubuntu:Pro:16.04:LTS: avahi, Ubuntu:Pro:18.04:LTS: avahi, Ubuntu:Pro:20.04:LTS: avahi, Ubuntu:22.04:LTS: avahi, Ubuntu:24.04:LTS: avahi, Ubuntu:25.10: avahi, Ubuntu:26.04:LTS: avahi</p> <p>Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-dae…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-59529 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2898 <p>Ein lokaler Angreifer kann eine Schwachstelle in avahi ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in avahi ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2898