What’s Vulnerable › Vulnerabilities

CVE-2024-52616: Avahi: avahi wide-area dns predictable transaction ids

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-21 · updated 2026-10-28
• Weakness: CWE-334

Description

A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.

Affected products

• avahi: before 0.9-rc2 — fixed in 0.9-rc2
• Red Hat OpenShift Container Platform 4.18: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions — fixed in 0:0.8-22.el9_6

How to fix

Upgrade to a fixed version: avahi 0.9-rc2; Red Hat Enterprise Linux 9 0:0.8-22.el9_6. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2025:7437
• https://access.redhat.com/security/cve/CVE-2024-52616
• https://bugzilla.redhat.com/show_bug.cgi?id=2326429
• https://github.com/avahi/avahi/pull/577

Get alerted when CVE-2024-52616 or the next vulnerability affects your stack