CVE-2026-48487 Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
An attacker on the local network can corrupt the mDNS cache by sending crafted packets with invalid record lengths, potentially disrupting service discovery.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48487?
CVE-2026-48487 is a medium-severity vulnerability in python-zeroconf, published on 17 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.
Weakness: CWE-130
Which versions are affected by CVE-2026-48487?
3 open source packages ship an affected version, including zeroconf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
zeroconf PyPI | All versions | 0.149.16 |
zeroconf PyPI | All versions | 0.149.16 |
zeroconf PyPI | All versions | 0.149.16 |
Linux distribution packages (1)
python-zeroconf openSUSE:Tumbleweed | All versions | 0.149.16-1.1 |
Products include Paulsm Zeroconf.
How do I fix CVE-2026-48487?
Upgrade zeroconf to 0.149.16 or later.
Is CVE-2026-48487 being exploited?
There is no known exploitation of CVE-2026-48487 in the wild and no public exploit code.
Other vulnerabilities in python-zeroconf
- CVE-2026-47180 Zeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of service
- CVE-2026-47183 zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion
- CVE-2026-47184 Zeroconf: Unbounded DNS record cache allows LAN-local memory exhaustion via multicast flood
- CVE-2026-48045 Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood
Sources
Also known as DEBIAN-CVE-2026-48487, GHSA-qc2x-6f54-m6h9, OESA-2026-2832, OESA-2026-2833, PYSEC-2026-3438, UBUNTU-CVE-2026-48487 and 1 more.