CVE-2026-34933 Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon

Medium 5.5 Published 3 Apr 2026 Updated 11 Apr 2026

An unprivileged local user can crash the Avahi daemon by sending a specific D-Bus call with conflicting flags, causing a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-34933?

CVE-2026-34933 is a medium-severity denial of service vulnerability in avahi, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.

Weakness: CWE-617

Which versions are affected by CVE-2026-34933?

It affects 1 product.

Linux distribution packages (1)

avahi openSUSE:Tumbleweed All versions 0.8-43.1

Products include Avahi Avahi.

How do I fix CVE-2026-34933?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-34933 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34933 exists.

Sources

Also known as ALPINE-CVE-2026-34933, AZL-81959, BELL-CVE-2026-34933, DEBIAN-CVE-2026-34933, ECHO-a71e-9fdf-9b3d, GHSA-w65r-6gxh-vhvc and 16 more.