CVE-2026-47183: Zeroconf Python mDNS DoS Vulnerability

CVE-2026-47183 Overview

CVE-2026-47183 is a memory exhaustion vulnerability in python-zeroconf, a pure Python implementation of multicast DNS (mDNS) service discovery. Versions prior to 0.149.6 retain an unbounded _seen_logs dictionary in DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods. The cache is keyed by attacker-influenced IncomingDecodeError messages and stores sys.exc_info() tracebacks whose frame locals retain raw packet self.data buffers. Unauthenticated hosts on the local link can send malformed mDNS packets over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. The issue is fixed in version 0.149.6.

Critical Impact
An unauthenticated adjacent-network attacker can exhaust process memory of any host running vulnerable python-zeroconf, causing denial of service to mDNS-dependent services or OOM termination of the host process.

Affected Products

python-zeroconf versions prior to 0.149.6
Applications embedding python-zeroconf for mDNS/DNS-SD service discovery
Home automation and IoT stacks that depend on python-zeroconf (for example, Home Assistant integrations)

Discovery Timeline

2026-07-17 - CVE-2026-47183 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47183

Vulnerability Analysis

The defect is a resource-exhaustion flaw classified as [CWE-400] (Uncontrolled Resource Consumption). The QuietLogger mixin and DNSIncoming._log_exception_debug deduplicate noisy exception logs by caching a signature of each exception in _seen_logs. The cache had no upper bound and was keyed on the string representation of IncomingDecodeError, which contains attacker-controlled bytes from malformed mDNS packets.

Each cache entry also stored the full sys.exc_info() tuple. Because Python exception tracebacks retain references to frame locals, the raw self.data packet buffer stayed live for every unique error signature. An attacker on the same broadcast domain can vary packet contents to produce a distinct error message per packet, forcing unbounded growth of both dictionary keys and retained packet buffers.

Root Cause

The root cause is two-fold: an unbounded deduplication cache and retention of exception state that pins large packet buffers in memory. Because mDNS listens on UDP/5353 bound to multicast groups 224.0.0.251 and ff02::fb, any host on the local link can trigger the affected code path without authentication or user interaction.

Attack Vector

An adjacent-network attacker sends a stream of malformed mDNS packets to the multicast group or directly to the victim on UDP/5353. Each malformed packet raises an IncomingDecodeError with a unique message, populating _seen_logs and retaining traceback frames. Sustained traffic degrades mDNS-dependent functionality and eventually causes the process to be terminated by the OS out-of-memory killer.

python

# Patch excerpt: src/zeroconf/_logger.py
 import logging
 import sys
-from typing import Any, ClassVar, cast
+from typing import Any
 
 log = logging.getLogger(__name__.split(".", maxsplit=1)[0])
 log.addHandler(logging.NullHandler())

python

# Patch excerpt: src/zeroconf/_protocol/incoming.py
     DNSText,
 )
 from .._exceptions import IncomingDecodeError
-from .._logger import log
+from .._logger import _mark_seen, log
 from .._utils.time import current_time_millis
 from ..const import (
     _FLAGS_QR_MASK,

Source: python-zeroconf commit 95561e28. The fix bounds _seen_logs and removes retention of exc_info, eliminating both the unbounded growth and the pinning of raw packet buffers.

Detection Methods for CVE-2026-47183

Indicators of Compromise

Sustained inbound UDP/5353 traffic to 224.0.0.251 or ff02::fb from a single local-link source at abnormal rates.
Steadily growing resident set size (RSS) of processes importing zeroconf without a corresponding increase in legitimate service discovery activity.
Repeated IncomingDecodeError entries in application logs with varying, non-repeating error text.
Processes terminated by the Linux OOM killer that host mDNS-dependent applications such as Home Assistant.

Detection Strategies

Inventory Python environments and identify installations of python-zeroconf at versions below 0.149.6 using pip list or SBOM scanning.
Monitor multicast DNS traffic volume on UDP/5353 per source host and alert on rates exceeding a baseline for the segment.
Instrument long-running Python processes with memory ceilings and alert on rapid RSS growth of services that embed zeroconf.

Monitoring Recommendations

Enable structured logging of IncomingDecodeError events and count unique error signatures over rolling windows.
Track OOM-killer events via dmesg or journalctl -k on hosts running mDNS-dependent services.
Deploy network sensors that flag anomalous local-link mDNS bursts on VLANs where mDNS is expected to be low-volume.

How to Mitigate CVE-2026-47183

Immediate Actions Required

Upgrade python-zeroconf to version 0.149.6 or later across all affected hosts and container images.
Rebuild and redeploy applications and appliances that vendor python-zeroconf as a bundled dependency.
Restart long-running processes after upgrade to release any already-retained tracebacks and packet buffers.

Patch Information

The fix is available in python-zeroconf 0.149.6 via pull request #1717, which bounds _seen_logs and stops retaining exc_info. See the GHSA-phvx-9mgw-67r5 advisory and the tracking issue #1714 for background.

Workarounds

Block or rate-limit inbound UDP/5353 traffic at the host firewall on segments where mDNS is not required.
Isolate untrusted devices from network segments that carry mDNS traffic for critical services.
Enforce per-process memory limits (for example, systemdMemoryMax=) so exhaustion attempts fail closed instead of degrading the host.

bash

# Upgrade python-zeroconf to the fixed release
pip install --upgrade 'zeroconf>=0.149.6'

# Verify the installed version
python -c "import zeroconf; print(zeroconf.__version__)"

# Optional: constrain mDNS traffic at the host firewall (Linux nftables example)
nft add rule inet filter input udp dport 5353 limit rate 50/second accept
nft add rule inet filter input udp dport 5353 drop