TI-2026-35849 Aliases CVE-2026-48487 GHSA-qc2x-6f54-m6h9

Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet

LOW 24CWE-130Published 2026-07-17 · Updated 2026-07-20

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00467 40th percentileScored 2026-11-07

Fix Partial python-zeroconf (python-zeroconf): 0.149.16zeroconf (PyPI): 0.149.16Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
python-zeroconf	python-zeroconf	before 0.149.16	0.149.16	Patch available	CNA
—	zeroconf (PyPI)	before 0.149.16	0.149.16	Patch available	GHSA-qc2x-6f54-m6h9

python-zeroconf Vendorpython-zeroconf Affected before 0.149.16 Fixed in 0.149.16 Patch available CNA
zeroconf (PyPI) Vendor— Affected before 0.149.16 Fixed in 0.149.16 Patch available GHSA-qc2x-6f54-m6h9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:paulsm:zeroconf::::::python::*	before 0.149.16	Vulnerable	python-zeroconf

cpe:2.3:a:paulsm:zeroconf:*:*:*:*:*:python:*:* Versions before 0.149.16 Vulnerable ·python-zeroconf

Remediation

Fix · CNA python-zeroconf (python-zeroconf) Fixed in 0.149.16
Fix · GHSA-qc2x-6f54-m6h9 zeroconf (PyPI) Fixed in 0.149.16 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 16.2	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 17.1	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 18.0	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-48487
2026-10-03 Alias added: GHSA-qc2x-6f54-m6h9

References

Patch 3

Advisory 1

https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9

Other 2

TI-2026-35487 Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood CVSS 3.1MEDIUM 6.5
TI-2026-34773 Zeroconf: Unbounded DNS record cache allows LAN-local memory exhaustion via multicast flood CVSS 3.1MEDIUM 6.5
TI-2026-34772 Uncontrolled resource consumption in python-zeroconf CVSS 3.1MEDIUM 6.5
TI-2026-34769 Zeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of service CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences