# CVE-2025-59529: Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In…

Source: https://junglewise.ai/threats/cve-2025-59529-avahi-is-a-system-which-facilitates-service-discovery-on-a-local  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-18  
License: CC BY 4.0 with a link back

CVE-2025-59529 · Severity: medium · CVSS 5.5 · Published 2025-12-18

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users.

Technologies: [Avahi](https://junglewise.ai/threats/technologies/avahi). Vendors: [Avahi](https://junglewise.ai/threats/vendors/avahi).

## Quick answers

**Is CVE-2025-59529 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59529 being exploited in the wild.

**How severe is CVE-2025-59529?** Medium severity, with a CVSS score of 5.5, published 18 December 2025.

**Which products and versions are affected?** Avahi. The advisory does not name versions.

**Is there a fix for CVE-2025-59529?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-59529?** Check whether you run Avahi. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Avahi

## Related threats

- [Avahi reachable assertion in avahi-daemon via D-Bus flags](https://junglewise.ai/threats/cve-2026-34933-avahi-reachable-assertion-in-avahi-daemon-via-d-bus-flags)
- [Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In…](https://junglewise.ai/threats/cve-2026-24401-avahi-is-a-system-which-facilitates-service-discovery-on-a-local)