Read the docs
TI-2019-07140 Aliases CVE-2019-9748GHSA-7425-crxp-55qx

In tinysvcmdns through 2018-01-16, an mDNS server processing a crafted packet can perform…

Priority MEDIUM 44CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

In tinysvcmdns through 2018-01-16, an mDNS server processing a crafted packet can perform arbitrary data read operations up to 16383 bytes from the start of the buffer. This can lead to a segmentation fault in uncompress_nlabel in mdns.c and a crash of the server (depending on the memory protection of the CPU and the operating system), or disclosure of memory content via error messages or a server response. NOTE: the product's web site states "This project is un-maintained, and has been since 2013. ... There are known vulnerabilities ... You are advised to NOT use this library for any new projects / products."

Why it matters now

EPSS 0.02418 84th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tinysvcmdns_project:tinysvcmdns:*:*:*:*:*:*:*:*up to 2018-01-16VulnerableTinysvcmdns Project
  • cpe:2.3:a:tinysvcmdns_project:tinysvcmdns:*:*:*:*:*:*:*:* Versions up to 2018-01-16 Vulnerable ·Tinysvcmdns Project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-9748
  2. 2026-10-03 Alias added: GHSA-7425-crxp-55qx

References

Exploit 1

  • TI-2017-08881 Memory corruption in geekman Tinysvcmdns CVSS 3.0CRITICAL 10.0
  • TI-2017-08923 NULL pointer dereference in Talos Tinysvcmdns CVSS 3.1HIGH 7.5
  • TI-2019-07139 In tinysvcmdns through 2018-01-16, a maliciously crafted mDNS (Multicast DNS) packet… CVSS 3.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences