CVE-2026-47180: Zeroconf Python mDNS DoS Vulnerability

CVE-2026-47180 Overview

CVE-2026-47180 is a denial-of-service vulnerability in python-zeroconf, a pure Python implementation of multicast DNS (mDNS) service discovery. The flaw resides in DNSIncoming._decode_labels_at_offset, which recurses once per DNS-name compression pointer without bounding the chain depth. A single crafted mDNS packet containing chained compression pointers triggers a RecursionError that escapes DNSIncoming.__init__. The resulting exception causes sustained CPU consumption, log flooding, and degradation of mDNS-dependent features. Any unauthenticated host on the local link can send the malicious packet over UDP/5353 to the multicast groups 224.0.0.251 (IPv4) or ff02::fb (IPv6). The issue is fixed in version 0.149.5 and is tracked as [CWE-674] Uncontrolled Recursion.

Critical Impact
Unauthenticated adjacent-network attackers can trigger sustained CPU exhaustion and log flooding on any host running vulnerable python-zeroconf by sending a single crafted mDNS packet.

Affected Products

python-zeroconf versions prior to 0.149.5
Applications and frameworks embedding python-zeroconf for mDNS/DNS-SD discovery
Home automation and IoT platforms that depend on Zeroconf for service discovery on the local link

Discovery Timeline

2026-07-17 - CVE-2026-47180 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47180

Vulnerability Analysis

The vulnerability is an uncontrolled recursion flaw in the mDNS packet parser. When python-zeroconf decodes DNS labels from an incoming packet, it follows DNS message compression pointers defined in RFC 1035. The parser invokes _decode_labels_at_offset recursively each time it encounters a pointer, and prior to 0.149.5 it did not track how deep the chain extended. A packet carrying dozens of chained pointers drives the Python call stack past its default limit, raising RecursionError. Because that exception was not listed in DECODE_EXCEPTIONS, it propagates out of DNSIncoming.__init__, is caught by the receive loop, and is logged for every subsequent packet, producing sustained CPU burn and log flooding on the target host.

Root Cause

The root cause is the absence of a depth bound in _decode_labels_at_offset combined with an incomplete exception filter. The seen_pointers set prevents infinite loops from cyclic references but does not limit how many distinct pointers can be chained. Python's recursion limit is reached before the loop guard triggers, and RecursionError was missing from DECODE_EXCEPTIONS, so parser failures escaped the intended error-handling path.

Attack Vector

Exploitation requires only local-link (adjacent network) access. An attacker joins the mDNS multicast groups 224.0.0.251 or ff02::fb on UDP/5353 and sends a single unicast or multicast packet whose name field contains a long chain of compression pointers. No authentication or user interaction is required. The impact is degraded availability of mDNS-dependent services, elevated CPU usage, and disk pressure from log flooding.

python

# Security patch: src/zeroconf/_protocol/incoming.py
 MAX_DNS_LABELS = 128
 MAX_NAME_LENGTH = 253

-DECODE_EXCEPTIONS = (IndexError, struct.error, IncomingDecodeError)
+DECODE_EXCEPTIONS = (IndexError, struct.error, IncomingDecodeError, RecursionError)


 _seen_logs: dict[str, int | tuple] = {}
# Source: https://github.com/python-zeroconf/python-zeroconf/commit/f9e23592137f30fdf7ef710dba065da31c79b1cf

The companion change in src/zeroconf/_protocol/incoming.pxd adds an explicit depth parameter to bound the recursion chain:

text

-    cdef unsigned int _decode_labels_at_offset(self, unsigned int off, cython.list labels, cython.set seen_pointers)
+    cdef unsigned int _decode_labels_at_offset(self, unsigned int off, cython.list labels, cython.set seen_pointers, unsigned int depth)
# Source: https://github.com/python-zeroconf/python-zeroconf/commit/f9e23592137f30fdf7ef710dba065da31c79b1cf

Detection Methods for CVE-2026-47180

Indicators of Compromise

Repeated RecursionError entries originating from DNSIncoming.__init__ or _decode_labels_at_offset in application logs.
Sustained high CPU on processes importing zeroconf following a burst of UDP/5353 traffic.
Unusually large or malformed mDNS packets addressed to 224.0.0.251 or ff02::fb from a single local-link source.

Detection Strategies

Inspect mDNS traffic for name fields that contain long chains of 0xC0-prefixed compression pointers exceeding typical service-discovery depth.
Correlate spikes in UDP/5353 packet counts with process-level CPU anomalies on hosts running python-zeroconf.
Alert on repeated Python traceback signatures referencing zeroconf._protocol.incoming in centralized logs.

Monitoring Recommendations

Enable flow-level visibility for UDP/5353 on wired and wireless segments where mDNS is permitted.
Track python-zeroconf package versions across the fleet and flag hosts running versions below 0.149.5.
Monitor log-ingestion volume from hosts that expose mDNS services and investigate sudden growth from a single source.

How to Mitigate CVE-2026-47180

Immediate Actions Required

Upgrade python-zeroconf to version 0.149.5 or later on every host, container, and appliance that embeds the library.
Inventory downstream projects (for example, Home Assistant components and IoT SDKs) that pin older zeroconf releases and force a transitive upgrade.
Restrict UDP/5353 exposure at network boundaries so untrusted devices cannot reach mDNS listeners.

Patch Information

The fix is delivered in python-zeroconf 0.149.5. It adds a depth argument to _decode_labels_at_offset to bound the compression-pointer chain and appends RecursionError to DECODE_EXCEPTIONS so malformed packets are handled inside the parser rather than escaping to callers. Additional context is available in the GitHub Security Advisory GHSA-9pgc-3ccv-5297 and Pull Request #1719.

Workarounds

Segment IoT and guest networks so untrusted clients cannot send packets to hosts running python-zeroconf.
Disable mDNS discovery in applications that do not require it until the library can be upgraded.
Apply host firewall rules that drop UDP/5353 from unexpected source addresses on sensitive systems.

bash

# Upgrade python-zeroconf to the patched release
pip install --upgrade 'zeroconf>=0.149.5'

# Verify the installed version
python -c "import zeroconf; print(zeroconf.__version__)"

# Temporary host firewall rule limiting mDNS to the local subnet (Linux)
sudo iptables -A INPUT -p udp --dport 5353 ! -s 192.0.2.0/24 -j DROP