CVE-2026-34933: Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-03 · updated 2026-07-24
Weakness: CWE-617

Description

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.

Affected products

avahi: before 0.9; 0.9-rc1, 0.9-rc2, 0.9-rc3 — fixed in 0.9

How to fix

Upgrade to a fixed version: avahi 0.9. Check the vendor advisory for mitigations.

References

https://github.com/avahi/avahi/commit/625ca0fac19229f6dfa3a6c6b698ae657187e50c
https://github.com/avahi/avahi/pull/891
https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc
http://www.openwall.com/lists/oss-security/2026/04/11/9
https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc

Get alerted when CVE-2026-34933 or the next vulnerability affects your stack