What’s Vulnerable › Vulnerabilities

CVE-2026-48487: Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-17 · updated 2026-08-17
• Weakness: CWE-130

Description

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.

Affected products

• python-zeroconf: before 0.149.16 — fixed in 0.149.16

How to fix

Upgrade to a fixed version: python-zeroconf 0.149.16. Check the vendor advisory for mitigations.

References

• https://github.com/python-zeroconf/python-zeroconf/commit/544449596e645fcaad3834fa0cb614a54f847a82
• https://github.com/python-zeroconf/python-zeroconf/issues/1752
• https://github.com/python-zeroconf/python-zeroconf/pull/1756
• https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.16
• https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9

Get alerted when CVE-2026-48487 or the next vulnerability affects your stack