Medium severity6.5GHSA Advisory· Published Jul 17, 2026· Updated Aug 17, 2026
CVE-2026-47184
CVE-2026-47184
Description
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, slower async_expire passes, and broken discovery, registration, and ServiceBrowser callbacks. This issue is fixed in version 0.149.7.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
zeroconfPyPI | < 0.149.7 | 0.149.7 |
Affected products
4- Range: < 0.149.7
- ghsa-coords2 versions
< 0.149.7+ 1 more
- (no CPE)range: < 0.149.7
- (no CPE)range: < 0.136.0-bp160.2.1
Patches
Vulnerability mechanics
References
6- github.com/python-zeroconf/python-zeroconf/commit/0ad3f37b5b852b8f614d322283d148efb2cef6e4nvdPatch
- github.com/python-zeroconf/python-zeroconf/issues/1715nvdIssue TrackingPatchWEB
- github.com/python-zeroconf/python-zeroconf/pull/1718nvdIssue TrackingPatchWEB
- github.com/advisories/GHSA-rfg2-pjw2-56x2ghsaADVISORY
- github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-rfg2-pjw2-56x2nvdVendor AdvisoryPatchWEB
- github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.7nvdRelease Notes
News mentions
0No linked articles in our index yet.