CVE-2026-48045

Katalog CVE

CVSS 6.5 · Medium EPSS 0,37%

Kerentanan Allocation of Resources Without Limits or Throttling pada paulsm zeroconf. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

17 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9663-mqmp-p9mm advisory vendor · patch
• https://github.com/python-zeroconf/python-zeroconf/commit/b22c8ff19c66c68907d220a4823c0950f4fa93f7 patch
• https://github.com/python-zeroconf/python-zeroconf/pull/1751 issue tracking · patch
• https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.12 release notes