CVE-2026-24401 Avahi has Uncontrolled Recursion in lookup_handle_cname function

Medium 6.5 Published 24 Jan 2026 Updated 23 Oct 2026

An attacker can crash the Avahi daemon by sending a malicious mDNS response with a recursive CNAME, causing stack exhaustion in specific configurations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-24401?

CVE-2026-24401 is a medium-severity denial of service vulnerability in avahi, published on 24 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.

Weakness: CWE-674

Which versions are affected by CVE-2026-24401?

It affects 1 product.

Linux distribution packages (13)

`avahi` SUSE:Linux Enterprise Micro 5.2	All versions	`0.7-150100.3.49.1`
`avahi` SUSE:Linux Enterprise Module for Basesystem 15 SP7	All versions	`0.8-150600.15.15.1`
`avahi-glib2` SUSE:Linux Enterprise Module for Basesystem 15 SP7	All versions	`0.8-150600.15.15.1`
`avahi` SUSE:Linux Enterprise Module for Desktop Applications 15 SP7	All versions	`0.8-150600.15.15.1`
`avahi-glib2` SUSE:Linux Enterprise Module for Desktop Applications 15 SP7	All versions	`0.8-150600.15.15.1`
`avahi` SUSE:Linux Enterprise Module for Package Hub 15 SP7	All versions	`0.8-150600.15.15.1`
`avahi` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`0.6.32-32.39.1`
`avahi` SUSE:Linux Micro 6.0	All versions	`0.8-8.1`
`avahi` SUSE:Linux Micro 6.1	All versions	`0.8-slfo.1.1_5.1`
`avahi` openSUSE:Leap 15.6	All versions	`0.8-150600.15.15.1`
`avahi-glib2` openSUSE:Leap 15.6	All versions	`0.8-150600.15.15.1`
`avahi-qt5` openSUSE:Leap 15.6	All versions	`0.8-150600.15.15.1`
`avahi` openSUSE:Tumbleweed	All versions	`0.8-44.1`

Products include Avahi Avahi.

How do I fix CVE-2026-24401?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-24401 being exploited?

There is no known exploitation of CVE-2026-24401 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2026-24401, AZL-75204, AZL-75207, BELL-CVE-2026-24401, CLSA-2026-1773137055, CLSA-2026-1778112033 and 13 more.