Vulnerability Details CVE-2026-48045
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 28.3%
CVSS Severity
CVSS v3 Score 6.5
Products affected by CVE-2026-48045
-
cpe:2.3:a:paulsm:zeroconf:-
-
cpe:2.3:a:paulsm:zeroconf:0.100.0
-
cpe:2.3:a:paulsm:zeroconf:0.101.0
-
cpe:2.3:a:paulsm:zeroconf:0.102.0
-
cpe:2.3:a:paulsm:zeroconf:0.103.0
-
cpe:2.3:a:paulsm:zeroconf:0.104.0
-
cpe:2.3:a:paulsm:zeroconf:0.105.0
-
cpe:2.3:a:paulsm:zeroconf:0.106.0
-
cpe:2.3:a:paulsm:zeroconf:0.107.0
-
cpe:2.3:a:paulsm:zeroconf:0.108.0
-
cpe:2.3:a:paulsm:zeroconf:0.109.0
-
cpe:2.3:a:paulsm:zeroconf:0.110.0
-
cpe:2.3:a:paulsm:zeroconf:0.111.0
-
cpe:2.3:a:paulsm:zeroconf:0.112.0
-
cpe:2.3:a:paulsm:zeroconf:0.113.0
-
cpe:2.3:a:paulsm:zeroconf:0.114.0
-
cpe:2.3:a:paulsm:zeroconf:0.115.0
-
cpe:2.3:a:paulsm:zeroconf:0.115.1
-
cpe:2.3:a:paulsm:zeroconf:0.115.2
-
cpe:2.3:a:paulsm:zeroconf:0.116.0
-
cpe:2.3:a:paulsm:zeroconf:0.117.0
-
cpe:2.3:a:paulsm:zeroconf:0.118.0
-
cpe:2.3:a:paulsm:zeroconf:0.118.1
-
cpe:2.3:a:paulsm:zeroconf:0.119.0
-
cpe:2.3:a:paulsm:zeroconf:0.120.0
-
cpe:2.3:a:paulsm:zeroconf:0.121.0
-
cpe:2.3:a:paulsm:zeroconf:0.122.0
-
cpe:2.3:a:paulsm:zeroconf:0.122.1
-
cpe:2.3:a:paulsm:zeroconf:0.122.2
-
cpe:2.3:a:paulsm:zeroconf:0.122.3
-
cpe:2.3:a:paulsm:zeroconf:0.123.0
-
cpe:2.3:a:paulsm:zeroconf:0.124.0
-
cpe:2.3:a:paulsm:zeroconf:0.125.0
-
cpe:2.3:a:paulsm:zeroconf:0.126.0
-
cpe:2.3:a:paulsm:zeroconf:0.127.0
-
cpe:2.3:a:paulsm:zeroconf:0.128.0
-
cpe:2.3:a:paulsm:zeroconf:0.128.1
-
cpe:2.3:a:paulsm:zeroconf:0.128.2
-
cpe:2.3:a:paulsm:zeroconf:0.128.3
-
cpe:2.3:a:paulsm:zeroconf:0.128.4
-
cpe:2.3:a:paulsm:zeroconf:0.128.5
-
cpe:2.3:a:paulsm:zeroconf:0.129.0
-
cpe:2.3:a:paulsm:zeroconf:0.13
-
cpe:2.3:a:paulsm:zeroconf:0.130.0
-
cpe:2.3:a:paulsm:zeroconf:0.131.0
-
cpe:2.3:a:paulsm:zeroconf:0.132.0
-
cpe:2.3:a:paulsm:zeroconf:0.132.1
-
cpe:2.3:a:paulsm:zeroconf:0.132.2
-
cpe:2.3:a:paulsm:zeroconf:0.133.0
-
cpe:2.3:a:paulsm:zeroconf:0.134.0
-
cpe:2.3:a:paulsm:zeroconf:0.135.0
-
cpe:2.3:a:paulsm:zeroconf:0.136.0
-
cpe:2.3:a:paulsm:zeroconf:0.136.1
-
cpe:2.3:a:paulsm:zeroconf:0.136.2
-
cpe:2.3:a:paulsm:zeroconf:0.137.0
-
cpe:2.3:a:paulsm:zeroconf:0.137.1
-
cpe:2.3:a:paulsm:zeroconf:0.137.2
-
cpe:2.3:a:paulsm:zeroconf:0.138.0
-
cpe:2.3:a:paulsm:zeroconf:0.138.1
-
cpe:2.3:a:paulsm:zeroconf:0.139.0
-
cpe:2.3:a:paulsm:zeroconf:0.14
-
cpe:2.3:a:paulsm:zeroconf:0.140.0
-
cpe:2.3:a:paulsm:zeroconf:0.140.1
-
cpe:2.3:a:paulsm:zeroconf:0.141.0
-
cpe:2.3:a:paulsm:zeroconf:0.142.0
-
cpe:2.3:a:paulsm:zeroconf:0.143.0
-
cpe:2.3:a:paulsm:zeroconf:0.143.1
-
cpe:2.3:a:paulsm:zeroconf:0.144.0
-
cpe:2.3:a:paulsm:zeroconf:0.144.1
-
cpe:2.3:a:paulsm:zeroconf:0.144.2
-
cpe:2.3:a:paulsm:zeroconf:0.144.3
-
cpe:2.3:a:paulsm:zeroconf:0.145.0
-
cpe:2.3:a:paulsm:zeroconf:0.145.1
-
cpe:2.3:a:paulsm:zeroconf:0.146.0
-
cpe:2.3:a:paulsm:zeroconf:0.146.1
-
cpe:2.3:a:paulsm:zeroconf:0.146.2
-
cpe:2.3:a:paulsm:zeroconf:0.146.3
-
cpe:2.3:a:paulsm:zeroconf:0.146.4
-
cpe:2.3:a:paulsm:zeroconf:0.146.5
-
cpe:2.3:a:paulsm:zeroconf:0.147.0
-
cpe:2.3:a:paulsm:zeroconf:0.147.1
-
cpe:2.3:a:paulsm:zeroconf:0.147.2
-
cpe:2.3:a:paulsm:zeroconf:0.147.3
-
cpe:2.3:a:paulsm:zeroconf:0.147.4
-
cpe:2.3:a:paulsm:zeroconf:0.148.0
-
cpe:2.3:a:paulsm:zeroconf:0.149.0
-
cpe:2.3:a:paulsm:zeroconf:0.149.1
-
cpe:2.3:a:paulsm:zeroconf:0.149.10
-
cpe:2.3:a:paulsm:zeroconf:0.149.11
-
cpe:2.3:a:paulsm:zeroconf:0.149.2
-
cpe:2.3:a:paulsm:zeroconf:0.149.3
-
cpe:2.3:a:paulsm:zeroconf:0.149.4
-
cpe:2.3:a:paulsm:zeroconf:0.149.5
-
cpe:2.3:a:paulsm:zeroconf:0.149.6
-
cpe:2.3:a:paulsm:zeroconf:0.149.7
-
cpe:2.3:a:paulsm:zeroconf:0.149.8
-
cpe:2.3:a:paulsm:zeroconf:0.149.9
-
cpe:2.3:a:paulsm:zeroconf:0.15
-
cpe:2.3:a:paulsm:zeroconf:0.15.1
-
cpe:2.3:a:paulsm:zeroconf:0.16
-
cpe:2.3:a:paulsm:zeroconf:0.17.0
-
cpe:2.3:a:paulsm:zeroconf:0.17.1
-
cpe:2.3:a:paulsm:zeroconf:0.17.2
-
cpe:2.3:a:paulsm:zeroconf:0.17.3
-
cpe:2.3:a:paulsm:zeroconf:0.17.4
-
cpe:2.3:a:paulsm:zeroconf:0.17.5
-
cpe:2.3:a:paulsm:zeroconf:0.17.6
-
cpe:2.3:a:paulsm:zeroconf:0.17.7
-
cpe:2.3:a:paulsm:zeroconf:0.18.0
-
cpe:2.3:a:paulsm:zeroconf:0.19.0
-
cpe:2.3:a:paulsm:zeroconf:0.19.1
-
cpe:2.3:a:paulsm:zeroconf:0.20.0
-
cpe:2.3:a:paulsm:zeroconf:0.21.0
-
cpe:2.3:a:paulsm:zeroconf:0.21.1
-
cpe:2.3:a:paulsm:zeroconf:0.21.2
-
cpe:2.3:a:paulsm:zeroconf:0.21.3
-
cpe:2.3:a:paulsm:zeroconf:0.22.0
-
cpe:2.3:a:paulsm:zeroconf:0.23.0
-
cpe:2.3:a:paulsm:zeroconf:0.24.0
-
cpe:2.3:a:paulsm:zeroconf:0.24.1
-
cpe:2.3:a:paulsm:zeroconf:0.24.2
-
cpe:2.3:a:paulsm:zeroconf:0.24.3
-
cpe:2.3:a:paulsm:zeroconf:0.24.4
-
cpe:2.3:a:paulsm:zeroconf:0.24.5
-
cpe:2.3:a:paulsm:zeroconf:0.25.0
-
cpe:2.3:a:paulsm:zeroconf:0.25.1
-
cpe:2.3:a:paulsm:zeroconf:0.26.0
-
cpe:2.3:a:paulsm:zeroconf:0.26.1
-
cpe:2.3:a:paulsm:zeroconf:0.26.2
-
cpe:2.3:a:paulsm:zeroconf:0.26.3
-
cpe:2.3:a:paulsm:zeroconf:0.27.0
-
cpe:2.3:a:paulsm:zeroconf:0.27.1
-
cpe:2.3:a:paulsm:zeroconf:0.28.0
-
cpe:2.3:a:paulsm:zeroconf:0.28.1
-
cpe:2.3:a:paulsm:zeroconf:0.28.2
-
cpe:2.3:a:paulsm:zeroconf:0.28.3
-
cpe:2.3:a:paulsm:zeroconf:0.28.4
-
cpe:2.3:a:paulsm:zeroconf:0.28.5
-
cpe:2.3:a:paulsm:zeroconf:0.28.6
-
cpe:2.3:a:paulsm:zeroconf:0.28.7
-
cpe:2.3:a:paulsm:zeroconf:0.28.8
-
cpe:2.3:a:paulsm:zeroconf:0.29.0
-
cpe:2.3:a:paulsm:zeroconf:0.30.0
-
cpe:2.3:a:paulsm:zeroconf:0.31.0
-
cpe:2.3:a:paulsm:zeroconf:0.32.0
-
cpe:2.3:a:paulsm:zeroconf:0.32.1
-
cpe:2.3:a:paulsm:zeroconf:0.33.0
-
cpe:2.3:a:paulsm:zeroconf:0.33.1
-
cpe:2.3:a:paulsm:zeroconf:0.33.2
-
cpe:2.3:a:paulsm:zeroconf:0.33.3
-
cpe:2.3:a:paulsm:zeroconf:0.33.4
-
cpe:2.3:a:paulsm:zeroconf:0.34.0
-
cpe:2.3:a:paulsm:zeroconf:0.34.1
-
cpe:2.3:a:paulsm:zeroconf:0.34.2
-
cpe:2.3:a:paulsm:zeroconf:0.34.3
-
cpe:2.3:a:paulsm:zeroconf:0.35.0
-
cpe:2.3:a:paulsm:zeroconf:0.35.1
-
cpe:2.3:a:paulsm:zeroconf:0.36.0
-
cpe:2.3:a:paulsm:zeroconf:0.36.1
-
cpe:2.3:a:paulsm:zeroconf:0.36.10
-
cpe:2.3:a:paulsm:zeroconf:0.36.11
-
cpe:2.3:a:paulsm:zeroconf:0.36.12
-
cpe:2.3:a:paulsm:zeroconf:0.36.13
-
cpe:2.3:a:paulsm:zeroconf:0.36.2
-
cpe:2.3:a:paulsm:zeroconf:0.36.3
-
cpe:2.3:a:paulsm:zeroconf:0.36.4
-
cpe:2.3:a:paulsm:zeroconf:0.36.5
-
cpe:2.3:a:paulsm:zeroconf:0.36.6
-
cpe:2.3:a:paulsm:zeroconf:0.36.7
-
cpe:2.3:a:paulsm:zeroconf:0.36.8
-
cpe:2.3:a:paulsm:zeroconf:0.36.9
-
cpe:2.3:a:paulsm:zeroconf:0.37.0
-
cpe:2.3:a:paulsm:zeroconf:0.38.0
-
cpe:2.3:a:paulsm:zeroconf:0.38.1
-
cpe:2.3:a:paulsm:zeroconf:0.38.2
-
cpe:2.3:a:paulsm:zeroconf:0.38.3
-
cpe:2.3:a:paulsm:zeroconf:0.38.4
-
cpe:2.3:a:paulsm:zeroconf:0.38.5
-
cpe:2.3:a:paulsm:zeroconf:0.38.6
-
cpe:2.3:a:paulsm:zeroconf:0.38.7
-
cpe:2.3:a:paulsm:zeroconf:0.39.0
-
cpe:2.3:a:paulsm:zeroconf:0.39.1
-
cpe:2.3:a:paulsm:zeroconf:0.39.2
-
cpe:2.3:a:paulsm:zeroconf:0.39.3
-
cpe:2.3:a:paulsm:zeroconf:0.39.4
-
cpe:2.3:a:paulsm:zeroconf:0.39.5
-
cpe:2.3:a:paulsm:zeroconf:0.40.0
-
cpe:2.3:a:paulsm:zeroconf:0.40.1
-
cpe:2.3:a:paulsm:zeroconf:0.41.0
-
cpe:2.3:a:paulsm:zeroconf:0.42.0
-
cpe:2.3:a:paulsm:zeroconf:0.43.0
-
cpe:2.3:a:paulsm:zeroconf:0.44.0
-
cpe:2.3:a:paulsm:zeroconf:0.45.0
-
cpe:2.3:a:paulsm:zeroconf:0.46.0
-
cpe:2.3:a:paulsm:zeroconf:0.47.0
-
cpe:2.3:a:paulsm:zeroconf:0.47.1
-
cpe:2.3:a:paulsm:zeroconf:0.47.2
-
cpe:2.3:a:paulsm:zeroconf:0.47.3
-
cpe:2.3:a:paulsm:zeroconf:0.47.4
-
cpe:2.3:a:paulsm:zeroconf:0.48.0
-
cpe:2.3:a:paulsm:zeroconf:0.49.0
-
cpe:2.3:a:paulsm:zeroconf:0.50.0
-
cpe:2.3:a:paulsm:zeroconf:0.51.0
-
cpe:2.3:a:paulsm:zeroconf:0.52.0
-
cpe:2.3:a:paulsm:zeroconf:0.53.0
-
cpe:2.3:a:paulsm:zeroconf:0.53.1
-
cpe:2.3:a:paulsm:zeroconf:0.54.0
-
cpe:2.3:a:paulsm:zeroconf:0.55.0
-
cpe:2.3:a:paulsm:zeroconf:0.56.0
-
cpe:2.3:a:paulsm:zeroconf:0.57.0
-
cpe:2.3:a:paulsm:zeroconf:0.58.0
-
cpe:2.3:a:paulsm:zeroconf:0.58.1
-
cpe:2.3:a:paulsm:zeroconf:0.58.2
-
cpe:2.3:a:paulsm:zeroconf:0.59.0
-
cpe:2.3:a:paulsm:zeroconf:0.60.0
-
cpe:2.3:a:paulsm:zeroconf:0.61.0
-
cpe:2.3:a:paulsm:zeroconf:0.62.0
-
cpe:2.3:a:paulsm:zeroconf:0.63.0
-
cpe:2.3:a:paulsm:zeroconf:0.64.0
-
cpe:2.3:a:paulsm:zeroconf:0.64.1
-
cpe:2.3:a:paulsm:zeroconf:0.65.0
-
cpe:2.3:a:paulsm:zeroconf:0.66.0
-
cpe:2.3:a:paulsm:zeroconf:0.67.0
-
cpe:2.3:a:paulsm:zeroconf:0.68.0
-
cpe:2.3:a:paulsm:zeroconf:0.68.1
-
cpe:2.3:a:paulsm:zeroconf:0.69.0
-
cpe:2.3:a:paulsm:zeroconf:0.70.0
-
cpe:2.3:a:paulsm:zeroconf:0.71.0
-
cpe:2.3:a:paulsm:zeroconf:0.71.1
-
cpe:2.3:a:paulsm:zeroconf:0.71.2
-
cpe:2.3:a:paulsm:zeroconf:0.71.3
-
cpe:2.3:a:paulsm:zeroconf:0.71.4
-
cpe:2.3:a:paulsm:zeroconf:0.71.5
-
cpe:2.3:a:paulsm:zeroconf:0.72.0
-
cpe:2.3:a:paulsm:zeroconf:0.72.1
-
cpe:2.3:a:paulsm:zeroconf:0.72.2
-
cpe:2.3:a:paulsm:zeroconf:0.72.3
-
cpe:2.3:a:paulsm:zeroconf:0.73.0
-
cpe:2.3:a:paulsm:zeroconf:0.74.0
-
cpe:2.3:a:paulsm:zeroconf:0.75.0
-
cpe:2.3:a:paulsm:zeroconf:0.76.0
-
cpe:2.3:a:paulsm:zeroconf:0.77.0
-
cpe:2.3:a:paulsm:zeroconf:0.78.0
-
cpe:2.3:a:paulsm:zeroconf:0.79.0
-
cpe:2.3:a:paulsm:zeroconf:0.80.0
-
cpe:2.3:a:paulsm:zeroconf:0.81.0
-
cpe:2.3:a:paulsm:zeroconf:0.82.0
-
cpe:2.3:a:paulsm:zeroconf:0.82.1
-
cpe:2.3:a:paulsm:zeroconf:0.83.0
-
cpe:2.3:a:paulsm:zeroconf:0.83.1
-
cpe:2.3:a:paulsm:zeroconf:0.84.0
-
cpe:2.3:a:paulsm:zeroconf:0.85.0
-
cpe:2.3:a:paulsm:zeroconf:0.86.0
-
cpe:2.3:a:paulsm:zeroconf:0.87.0
-
cpe:2.3:a:paulsm:zeroconf:0.88.0
-
cpe:2.3:a:paulsm:zeroconf:0.89.0
-
cpe:2.3:a:paulsm:zeroconf:0.90.0
-
cpe:2.3:a:paulsm:zeroconf:0.91.0
-
cpe:2.3:a:paulsm:zeroconf:0.91.1
-
cpe:2.3:a:paulsm:zeroconf:0.92.0
-
cpe:2.3:a:paulsm:zeroconf:0.93.0
-
cpe:2.3:a:paulsm:zeroconf:0.93.1
-
cpe:2.3:a:paulsm:zeroconf:0.94.0
-
cpe:2.3:a:paulsm:zeroconf:0.95.0
-
cpe:2.3:a:paulsm:zeroconf:0.96.0
-
cpe:2.3:a:paulsm:zeroconf:0.97.0
-
cpe:2.3:a:paulsm:zeroconf:0.98.0
-
cpe:2.3:a:paulsm:zeroconf:0.99.0