CVE-2026-48487

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48487", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-21T15:33:08.291Z", "datePublished": "2026-07-17T18:28:21.417Z", "dateUpdated": "2026-07-20T19:26:06.005Z"}, "containers": {"cna": {"title": "Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet", "problemTypes": [{"descriptions": [{"cweId": "CWE-130", "lang": "en", "description": "CWE-130: Improper Handling of Length Parameter Inconsistency", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9"}, {"name": "https://github.com/python-zeroconf/python-zeroconf/issues/1752", "tags": ["x_refsource_MISC"], "url": "https://github.com/python-zeroconf/python-zeroconf/issues/1752"}, {"name": "https://github.com/python-zeroconf/python-zeroconf/pull/1756", "tags": ["x_refsource_MISC"], "url": "https://github.com/python-zeroconf/python-zeroconf/pull/1756"}, {"name": "https://github.com/python-zeroconf/python-zeroconf/commit/544449596e645fcaad3834fa0cb614a54f847a82", "tags": ["x_refsource_MISC"], "url": "https://github.com/python-zeroconf/python-zeroconf/commit/544449596e645fcaad3834fa0cb614a54f847a82"}, {"name": "https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.16", "tags": ["x_refsource_MISC"], "url": "https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.16"}], "affected": [{"vendor": "python-zeroconf", "product": "python-zeroconf", "versions": [{"version": "< 0.149.16", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T18:28:21.417Z"}, "descriptions": [{"lang": "en", "value": "Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16."}], "source": {"advisory": "GHSA-qc2x-6f54-m6h9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T19:25:21.589707Z", "id": "CVE-2026-48487", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:26:06.005Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48487", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T19:25:21.589707Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:25:55.762Z"}}], "cna": {"title": "Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet", "source": {"advisory": "GHSA-qc2x-6f54-m6h9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "python-zeroconf", "product": "python-zeroconf", "versions": [{"status": "affected", "version": "< 0.149.16"}]}], "references": [{"url": "https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9", "name": "https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/python-zeroconf/python-zeroconf/issues/1752", "name": "https://github.com/python-zeroconf/python-zeroconf/issues/1752", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/python-zeroconf/python-zeroconf/pull/1756", "name": "https://github.com/python-zeroconf/python-zeroconf/pull/1756", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/python-zeroconf/python-zeroconf/commit/544449596e645fcaad3834fa0cb614a54f847a82", "name": "https://github.com/python-zeroconf/python-zeroconf/commit/544449596e645fcaad3834fa0cb614a54f847a82", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.16", "name": "https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.16", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-130", "description": "CWE-130: Improper Handling of Length Parameter Inconsistency"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T18:28:21.417Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48487", "state": "PUBLISHED", "dateUpdated": "2026-07-20T19:26:06.005Z", "dateReserved": "2026-05-21T15:33:08.291Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-17T18:28:21.417Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "python-zeroconf", "vendor": "python-zeroconf", "versions": [{"status": "affected", "version": "< 0.149.16"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:paulsm:zeroconf:*:*:*:*:*:python:*:*", "matchCriteriaId": "5816907C-5CAF-46BA-B0FC-BE64A87D7E72", "versionEndExcluding": "0.149.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16."}], "id": "CVE-2026-48487", "lastModified": "2026-08-17T20:06:33.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48487", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T19:25:21.589707Z", "version": "2.0.3"}}]}, "published": "2026-07-17T19:17:15.963", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/python-zeroconf/python-zeroconf/commit/544449596e645fcaad3834fa0cb614a54f847a82"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/python-zeroconf/python-zeroconf/issues/1752"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/python-zeroconf/python-zeroconf/pull/1756"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.16"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-130"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "zeroconf: Zeroconf: Data integrity vulnerability via malformed DNS records", "id": "2501840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501840"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-120", "details": ["A flaw was found in Zeroconf, a Python library for multicast DNS service discovery. An unauthenticated attacker on the local network can exploit a vulnerability in how the system processes incoming DNS records. By sending a specially crafted record with an excessive length, the attacker can cause the system's DNS cache and service information to be populated with manipulated or truncated data. This could lead to incorrect service discovery or other data integrity issues within the affected system."], "mitigation": {"lang": "en:us", "value": "Upgrade to zeroconf 0.149.16 or later once packaged in the affected Red Hat product. Where upgrading isn't immediately possible, restricting the affected host's exposure to the local network segment (network segmentation or firewalling multicast DNS traffic on UDP/5353) reduces the practical attack surface, since exploitation requires local-link access."}, "name": "CVE-2026-48487", "public_date": "2026-07-17T18:28:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48487\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48487\nhttps://github.com/python-zeroconf/python-zeroconf/commit/544449596e645fcaad3834fa0cb614a54f847a82\nhttps://github.com/python-zeroconf/python-zeroconf/issues/1752\nhttps://github.com/python-zeroconf/python-zeroconf/pull/1756\nhttps://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.16\nhttps://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9"], "statement": "Zeroconf is a pure Python implementation of multicast DNS (mDNS) service discovery. Prior to 0.149.16, the record string/character-string readers advance the parser offset using an attacker-declared RDLENGTH without checking it against the actual buffer length, allowing a malformed TXT, HINFO, or A/AAAA record to corrupt subsequent record parsing, resulting in data integrity impact for unauthenticated hosts on the local network segment (UDP/5353, 224.0.0.251 / ff02::fb). Exploitation requires the attacker to be on the same local link as the affected host, consistent with Red Hat's Adjacent (AV:A) attack vector scoring. This issue is fixed upstream in zeroconf 0.149.16.\nRed Hat's CVSS score matches the vendor/CVE.org assessment for this flaw. This flaw is one of a batch of related Zeroconf issues discovered and fixed close together (CVE-2026-47180, CVE-2026-47183, CVE-2026-47184, CVE-2026-48045, CVE-2026-48487); all affect the same Red Hat product streams in the same way and were triaged consistently as a batch.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.149.16)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "python-zeroconf", "source": "cna", "vendor": "python-zeroconf"}, "product": "python-zeroconf", "vendor": "python-zeroconf"}], "created": "2026-07-22T20:00:04.675946+00:00", "updated": "2026-08-04T07:15:03.924676+00:00", "vendors": ["python-zeroconf", "python-zeroconf$PRODUCT$python-zeroconf"]}