zeroconf
PyPI5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting zeroconfpage 1 of 1
- CVE-2026-47180MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.149.52026-05-29
vulnerable: 0.100.0 ... 0.99.0 (251 versions)
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trig…
- CVE-2026-47183MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.149.62026-05-29
vulnerable: 0.100.0 ... 0.99.0 (252 versions)
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-in…
- CVE-2026-47184MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.149.72026-05-29
vulnerable: 0.100.0 ... 0.99.0 (253 versions)
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache without a cap, allowing unauthentic…
- CVE-2026-48045MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.149.122026-06-11
vulnerable: 0.100.0 ... 0.99.0 (258 versions)
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferre…
- CVE-2026-48487MEDIUMCVSS 5.3EG 6.5✓ Fixed in 0.149.162026-06-22
vulnerable: 0.100.0 ... 0.99.0 (259 versions)
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checki…
Check whether zeroconf is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for zeroconf CVEs against the assets you own.
Start Free Scan →