What’s Vulnerable › Vulnerabilities

CVE-2026-24401: Avahi has Uncontrolled Recursion in lookup_handle_cname function

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-24 · updated 2026-10-23
• Weakness: CWE-674

Description

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.

Affected products

• avahi: before 0.9; 0.9-rc1, 0.9-rc2 — fixed in 0.9

How to fix

Upgrade to a fixed version: avahi 0.9. Check the vendor advisory for mitigations.

References

• https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524
• https://github.com/avahi/avahi/issues/501
• https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3

Get alerted when CVE-2026-24401 or the next vulnerability affects your stack