What’s Vulnerable › Vulnerabilities

CVE-2024-52615: Avahi: avahi wide-area dns uses constant source port

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-21 · updated 2026-10-28
• Weakness: CWE-330

Description

A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.

Affected products

• avahi: before 0.9-rc3 — fixed in 0.9-rc3
• Red Hat OpenShift Container Platform 4.18: all versions
• Red Hat Enterprise Linux 10: all versions — fixed in 0:0.9~rc2-1.el10_0.1
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions — fixed in 0:0.8-22.el9_6.1

How to fix

Upgrade to a fixed version: avahi 0.9-rc3; Red Hat Enterprise Linux 10 0:0.9~rc2-1.el10_0.1; Red Hat Enterprise Linux 9 0:0.8-22.el9_6.1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2025:11402
• https://access.redhat.com/errata/RHSA-2025:16441
• https://access.redhat.com/security/cve/CVE-2024-52615
• https://bugzilla.redhat.com/show_bug.cgi?id=2326418
• https://github.com/avahi/avahi/pull/577

Get alerted when CVE-2024-52615 or the next vulnerability affects your stack