CVE-2026-48045: Zeroconf Python Library DOS Vulnerability

CVE-2026-48045 Overview

CVE-2026-48045 is a resource exhaustion vulnerability in python-zeroconf, a pure Python implementation of multicast DNS (mDNS) service discovery. Versions prior to 0.149.12 fail to cap the deferred-query storage used by AsyncListener.handle_query_or_defer when processing truncated (TC-bit) DNS messages. Unauthenticated hosts on the local link can spoof source addresses over UDP port 5353 (224.0.0.251 / ff02::fb) and force unbounded growth of the _deferred and _timers dictionaries. The resulting memory exhaustion and quadratic CPU consumption produce a denial-of-service condition on the affected host.

Critical Impact
Adjacent-network attackers can exhaust memory and CPU on any host running vulnerable python-zeroconf, disrupting mDNS-dependent services such as Home Assistant, printer discovery, and IoT device advertisement.

Affected Products

python-zeroconf versions prior to 0.149.12
Applications embedding python-zeroconf for mDNS/DNS-SD service discovery
Home automation, IoT, and network discovery stacks depending on the affected library

Discovery Timeline

2026-07-17 - CVE-2026-48045 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database
Fix released in python-zeroconf version 0.149.12 (see GitHub Release 0.149.12)

Technical Details for CVE-2026-48045

Vulnerability Analysis

The flaw resides in AsyncListener.handle_query_or_defer inside src/zeroconf/_listener.py. When an incoming DNS packet has the TC (truncation) bit set, zeroconf retains the fragment in self._deferred[addr] and starts a per-address timer in self._timers[addr] while waiting for the follow-up fragment. Each retained fragment can be up to _MAX_MSG_ABSOLUTE = 8966 bytes. Before the patch, the implementation applied no cap on either the number of distinct addr keys or the length of the per-address deferred list. An attacker sending TC-bit queries with arbitrary spoofed source addresses forces the map to grow indefinitely, driving memory usage upward while iteration and cleanup routines exhibit quadratic behavior. This condition maps to [CWE-770] Allocation of Resources Without Limits or Throttling.

Root Cause

The deferred-query buffer trusted the source address of unauthenticated UDP mDNS traffic and used it as an unbounded map key. Because mDNS runs on the local link without cryptographic source validation, spoofing is trivial. The absence of _MAX_DEFERRED_ADDRS and _MAX_DEFERRED_PER_ADDR bounds allowed the data structures backing fragment reassembly to expand without limit.

Attack Vector

An adjacent-network attacker sends a stream of crafted mDNS queries with the TC bit set to 224.0.0.251 (IPv4) or ff02::fb (IPv6) on UDP/5353. Each packet uses a different spoofed source IP. The listener stores each packet in the deferred queue and arms a timer per unique source. Sustained traffic exhausts host memory and CPU, degrading or crashing the process.

python

# Patch excerpt from src/zeroconf/_listener.py
from ._protocol.incoming import DNSIncoming
from ._transport import _WrappedTransport, make_wrapped_transport
from ._utils.time import current_time_millis, millis_to_seconds
from .const import (
    _DUPLICATE_PACKET_SUPPRESSION_INTERVAL,
    _MAX_DEFERRED_ADDRS,
    _MAX_DEFERRED_PER_ADDR,
    _MAX_MSG_ABSOLUTE,
    _RECENT_PACKETS_MAX,
)

Source: GitHub Commit b22c8ff. The fix introduces _MAX_DEFERRED_ADDRS and _MAX_DEFERRED_PER_ADDR caps enforced when queuing fragments.

Detection Methods for CVE-2026-48045

Indicators of Compromise

Sustained bursts of UDP/5353 packets destined for 224.0.0.251 or ff02::fb originating from many distinct, often non-routable, source addresses
mDNS query packets with the TC (truncation) bit set arriving without corresponding follow-up TCP queries
Rapid growth of Python process resident memory on hosts running python-zeroconf

Detection Strategies

Baseline normal mDNS traffic volume per subnet and alert on sudden increases in unique source IPs on UDP/5353
Inspect mDNS traffic for the DNS header flags byte and count packets with the TC bit set; a high ratio of truncated queries is anomalous
Correlate high CPU or memory utilization in processes importing zeroconf with concurrent link-local multicast traffic spikes

Monitoring Recommendations

Log Python application memory and event-loop latency for services using python-zeroconf and alert on sustained upward trends
Deploy IDS signatures on local segments to flag high-rate TC-bit mDNS queries with rotating source addresses
Track installed python-zeroconf versions across the environment using software bill of materials (SBOM) tooling

How to Mitigate CVE-2026-48045

Immediate Actions Required

Upgrade python-zeroconf to version 0.149.12 or later on every affected host
Identify downstream applications that vendor python-zeroconf and apply their updated releases
Restrict UDP/5353 traffic at network boundaries and between VLANs so only trusted local segments can reach mDNS listeners

Patch Information

The fix is delivered in python-zeroconf0.149.12 via pull request #1751 and commit b22c8ff. The patch adds _MAX_DEFERRED_ADDRS and _MAX_DEFERRED_PER_ADDR constants that bound the size of self._deferred and self._timers, preventing spoofed-source floods from causing out-of-memory conditions. Additional context is available in the GitHub Security Advisory GHSA-9663-mqmp-p9mm.

Workarounds

Block or rate-limit UDP/5353 traffic from untrusted network segments using host or network firewalls
Isolate IoT and discovery-dependent services onto dedicated VLANs that do not accept mDNS traffic from user or guest networks
Disable python-zeroconf in applications where mDNS service discovery is not required

bash

# Upgrade to the patched release
pip install --upgrade 'zeroconf>=0.149.12'

# Verify installed version
python -c "import zeroconf; print(zeroconf.__version__)"

# Example: rate-limit inbound mDNS on Linux (nftables)
nft add rule inet filter input udp dport 5353 limit rate 50/second accept
nft add rule inet filter input udp dport 5353 drop