Executive brief
A vulnerability in the Zeroconf Python library, which is used for automatic device discovery on local networks (such as finding printers or smart home devices), allows an attacker on the same network to crash or slow down the service. By sending a specially crafted network packet, an attacker can cause the software to consume excessive CPU resources and flood system logs. This can lead to a denial-of-service for features like HomeKit, AirPlay, and Chromecast, particularly on low-power hardware like Raspberry Pi.
Technical details
The vulnerability exists in the `DNSIncoming._decode_labels_at_offset` method of the `python-zeroconf` library. The decoder recurses for every DNS-name compression pointer encountered in an mDNS packet. While cycles and label counts were previously capped, the chain length of unique forward pointers was not. An unauthenticated attacker on the local link (UDP/5353) can send a ~3 kB packet containing ~1500 chained pointers to exceed CPython's default recursion limit. Because `RecursionError` was not caught within the decoder's exception handling, it bubbles up to the asyncio event loop, causing sustained CPU exhaustion and log flooding. The issue is fixed in version 0.149.5 by implementing a hard cap on pointer-chain depth.
Affected products
- python-zeroconf zeroconf < 0.149.5
Timeline
- 2026-05-18: patched: Fix merged in PR #1719 and released in v0.149.5
- 2026-07-17: advisory: CVE-2026-47180 published
References
- https://github.com/python-zeroconf/python-zeroconf/commit/f9e23592137f30fdf7ef710dba065da31c79b1cf
- https://github.com/python-zeroconf/python-zeroconf/pull/1719
- https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.5
- https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9pgc-3ccv-5297