CVE-2026-47184: Zeroconf Python mDNS DoS Vulnerability

CVE-2026-47184 Overview

CVE-2026-47184 is a resource exhaustion vulnerability in python-zeroconf, a pure Python implementation of multicast DNS (mDNS) service discovery. Versions prior to 0.149.7 fail to cap entries added to the DNSCache when processing incoming responses. An unauthenticated attacker on the local link can multicast crafted mDNS responses with unique names over UDP/5353 (224.0.0.251 / ff02::fb) and force unbounded cache growth. This leads to memory exhaustion, degraded cache lookup performance, slow async_expire passes, and broken discovery, registration, and ServiceBrowser callbacks. The issue was fixed in version 0.149.7 by bounding the cache size.

Critical Impact
A local-network attacker can exhaust host memory and break mDNS service discovery on any application embedding vulnerable python-zeroconf, including many home automation and IoT stacks.

Affected Products

python-zeroconf versions prior to 0.149.7
Applications and platforms embedding python-zeroconf for mDNS service discovery
Home Assistant and other Python-based IoT projects depending on python-zeroconf

Discovery Timeline

2026-07-17 - CVE-2026-47184 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47184

Vulnerability Analysis

The flaw exists in the DNSCache._async_add method. Each incoming response record is inserted into the cache, _expirations, _expire_heap, and service_cache structures without any upper bound. An attacker on the same link can multicast valid mDNS responses containing many unique record names. Each unique record consumes memory across all four structures. Because mDNS is unauthenticated and multicast, no credentials or user interaction are required. The condition maps to CWE-770 (Allocation of Resources Without Limits or Throttling).

Root Cause

The cache write path did not enforce a maximum record count. Legitimate mDNS traffic is bounded by the small number of services on a link, so the codebase historically assumed cache size would remain modest. A malicious peer breaks this assumption by generating arbitrary unique names. As the cache grows, expiration heap operations and lookup paths degrade further, compounding the impact beyond simple memory pressure.

Attack Vector

Exploitation requires adjacent network access (AV:A). The attacker sends crafted mDNS response packets to the multicast group 224.0.0.251 (IPv4) or ff02::fb (IPv6) on UDP port 5353. Each packet contains records with unique service names. The victim process ingests these responses and appends them to its cache indefinitely, driving memory use up until the host or process fails.

python

# Security patch in src/zeroconf/const.py
# Source: https://github.com/python-zeroconf/python-zeroconf/commit/0ad3f37b5b852b8f614d322283d148efb2cef6e4

# level of rate limit and safe guards so we use 1/4 of the recommended value
_DNS_PTR_MIN_TTL = 1125

# Upper bound on the number of records the DNSCache will hold before it
# starts evicting the closest-to-expiration entry to make room for new
# arrivals. Bounds the memory a malicious LAN peer can force the cache
# to retain by multicasting many unique-name records.
_MAX_CACHE_RECORDS = 10000

_DNS_PACKET_HEADER_LEN = 12

The patch introduces _MAX_CACHE_RECORDS = 10000 and evicts the entry closest to expiration when the cache reaches this limit. A corresponding cdef unsigned int _MAX_CACHE_RECORDS declaration was added to src/zeroconf/_cache.pxd.

Detection Methods for CVE-2026-47184

Indicators of Compromise

Sustained inbound UDP traffic to port 5353 from a single LAN peer generating high-cardinality unique service names.
Rapid resident memory growth in Python processes hosting python-zeroconf without corresponding application workload increase.
Application logs showing slow async_expire iterations or failing ServiceBrowser callbacks.

Detection Strategies

Monitor process RSS for hosts running mDNS-dependent applications and alert on unbounded growth trends.
Baseline mDNS traffic volume per LAN segment and alert on packet-rate anomalies to 224.0.0.251 or ff02::fb.
Inventory Python environments for python-zeroconf < 0.149.7 using software composition analysis on pip lockfiles and container images.

Monitoring Recommendations

Capture UDP/5353 flow telemetry at network sensors and correlate source hosts against expected mDNS responders.
Track DNSCache size where instrumentation is available and alert when growth deviates from historical norms.
Log restarts and OOM kills of services embedding python-zeroconf for post-incident correlation.

How to Mitigate CVE-2026-47184

Immediate Actions Required

Upgrade python-zeroconf to 0.149.7 or later in all affected environments, including container images and dependent applications.
Identify indirect dependencies pulling in python-zeroconf and rebuild downstream packages with the fixed version.
Restart long-running services after the upgrade so the bounded cache logic takes effect.

Patch Information

The fix is available in python-zeroconf 0.149.7. Technical context is documented in the GitHub Security Advisory GHSA-rfg2-pjw2-56x2, the issue discussion, the pull request, and the remediation commit.

Workarounds

Restrict UDP/5353 traffic at Layer 2 or Layer 3 to trusted mDNS responders where segmentation permits.
Isolate untrusted devices onto separate VLANs so they cannot reach hosts running python-zeroconf.
Enforce host-based firewall rules that limit inbound multicast DNS traffic on servers that do not require discovery.

bash

# Upgrade python-zeroconf to the patched release
pip install --upgrade 'zeroconf>=0.149.7'

# Verify the installed version
python -c "import zeroconf; print(zeroconf.__version__)"

# Optional: block UDP/5353 from untrusted interfaces using iptables
iptables -A INPUT -i eth1 -p udp --dport 5353 -j DROP