CVE-2026-48045

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48045", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:15:53.578Z", "datePublished": "2026-07-17T18:26:19.274Z", "dateUpdated": "2026-07-17T19:21:38.396Z"}, "containers": {"cna": {"title": "Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9663-mqmp-p9mm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9663-mqmp-p9mm"}, {"name": "https://github.com/python-zeroconf/python-zeroconf/pull/1751", "tags": ["x_refsource_MISC"], "url": "https://github.com/python-zeroconf/python-zeroconf/pull/1751"}, {"name": "https://github.com/python-zeroconf/python-zeroconf/commit/b22c8ff19c66c68907d220a4823c0950f4fa93f7", "tags": ["x_refsource_MISC"], "url": "https://github.com/python-zeroconf/python-zeroconf/commit/b22c8ff19c66c68907d220a4823c0950f4fa93f7"}, {"name": "https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.12", "tags": ["x_refsource_MISC"], "url": "https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.12"}], "affected": [{"vendor": "python-zeroconf", "product": "python-zeroconf", "versions": [{"version": "< 0.149.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T18:26:19.274Z"}, "descriptions": [{"lang": "en", "value": "Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12."}], "source": {"advisory": "GHSA-9663-mqmp-p9mm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-17T19:21:32.304752Z", "id": "CVE-2026-48045", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T19:21:38.396Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48045", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:15:53.578Z", "datePublished": "2026-07-17T18:26:19.274Z", "dateUpdated": "2026-07-17T19:21:38.396Z"}, "containers": {"cna": {"title": "Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9663-mqmp-p9mm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9663-mqmp-p9mm"}, {"name": "https://github.com/python-zeroconf/python-zeroconf/pull/1751", "tags": ["x_refsource_MISC"], "url": "https://github.com/python-zeroconf/python-zeroconf/pull/1751"}, {"name": "https://github.com/python-zeroconf/python-zeroconf/commit/b22c8ff19c66c68907d220a4823c0950f4fa93f7", "tags": ["x_refsource_MISC"], "url": "https://github.com/python-zeroconf/python-zeroconf/commit/b22c8ff19c66c68907d220a4823c0950f4fa93f7"}, {"name": "https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.12", "tags": ["x_refsource_MISC"], "url": "https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.12"}], "affected": [{"vendor": "python-zeroconf", "product": "python-zeroconf", "versions": [{"version": "< 0.149.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T18:26:19.274Z"}, "descriptions": [{"lang": "en", "value": "Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12."}], "source": {"advisory": "GHSA-9663-mqmp-p9mm", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48045", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T19:21:32.304752Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T19:21:34.875Z"}}]}}

{"affected": [{"affectedData": [{"product": "python-zeroconf", "vendor": "python-zeroconf", "versions": [{"status": "affected", "version": "< 0.149.12"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:paulsm:zeroconf:*:*:*:*:*:python:*:*", "matchCriteriaId": "59B84DF3-0AB4-4C76-A00D-35BBEEDCFB60", "versionEndExcluding": "0.149.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12."}], "id": "CVE-2026-48045", "lastModified": "2026-08-17T20:03:08.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48045", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-17T19:21:32.304752Z", "version": "2.0.3"}}]}, "published": "2026-07-17T19:17:15.820", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/python-zeroconf/python-zeroconf/commit/b22c8ff19c66c68907d220a4823c0950f4fa93f7"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/python-zeroconf/python-zeroconf/pull/1751"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.12"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory", "Patch"], "url": "https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9663-mqmp-p9mm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "zeroconf: Zeroconf: Unauthenticated network attacker can cause Denial of Service", "id": "2501852", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501852"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in zeroconf, a Python library for network service discovery. This vulnerability allows an unauthenticated attacker on the local network to send specially crafted queries. These queries can cause the system to retain large amounts of data and trigger excessive processing, leading to a denial of service (DoS) due to memory exhaustion and high CPU usage."], "mitigation": {"lang": "en:us", "value": "Upgrade to zeroconf 0.149.12 or later once packaged in the affected Red Hat product. Where upgrading isn't immediately possible, restricting the affected host's exposure to the local network segment (network segmentation or firewalling multicast DNS traffic on UDP/5353) reduces the practical attack surface, since exploitation requires local-link access."}, "name": "CVE-2026-48045", "public_date": "2026-07-17T18:26:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48045\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48045\nhttps://github.com/python-zeroconf/python-zeroconf/commit/b22c8ff19c66c68907d220a4823c0950f4fa93f7\nhttps://github.com/python-zeroconf/python-zeroconf/pull/1751\nhttps://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.12\nhttps://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9663-mqmp-p9mm"], "statement": "Zeroconf is a pure Python implementation of multicast DNS (mDNS) service discovery. Prior to 0.149.12, truncated (TC-bit) incoming queries are retained per source address with a per-address timer armed, but neither the deferred query list nor the number of distinct addresses is capped, allowing memory and timer exhaustion from a flood of truncated queries, resulting in denial of service impact for unauthenticated hosts on the local network segment (UDP/5353, 224.0.0.251 / ff02::fb). Exploitation requires the attacker to be on the same local link as the affected host, consistent with Red Hat's Adjacent (AV:A) attack vector scoring. This issue is fixed upstream in zeroconf 0.149.12.\nRed Hat's CVSS score matches the vendor/CVE.org assessment for this flaw. This flaw is one of a batch of related Zeroconf issues discovered and fixed close together (CVE-2026-47180, CVE-2026-47183, CVE-2026-47184, CVE-2026-48045, CVE-2026-48487); all affect the same Red Hat product streams in the same way and were triaged consistently as a batch.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.149.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "python-zeroconf", "source": "cna", "vendor": "python-zeroconf"}, "product": "python-zeroconf", "vendor": "python-zeroconf"}], "created": "2026-07-22T20:00:04.676136+00:00", "updated": "2026-07-31T00:00:06.193476+00:00", "vendors": ["python-zeroconf", "python-zeroconf$PRODUCT$python-zeroconf"]}