CVE-2026-34933 — Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon

Affected: avahi

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.

USN-8269-1 — avahi vulnerabilities

Affected: Ubuntu:Pro:14.04:LTS: avahi, Ubuntu:Pro:16.04:LTS: avahi, Ubuntu:Pro:18.04:LTS: avahi, Ubuntu:Pro:20.04:LTS: avahi, Ubuntu:22.04:LTS: avahi, Ubuntu:24.04:LTS: avahi, Ubuntu:25.10: avahi, Ubuntu:26.04:LTS: avahi

It is discovered that Avahi incorrectly handled crafted input. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-24401)

Guillaume Meunier discovered that Avahi incorrectly handled crafted input. An attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2026-34933)

Most recent entries from all

CVE-2026-34933 — Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon

USN-8269-1 — avahi vulnerabilities