CVE-2026-47183: python-zeroconf memory exhaustion via malformed mDNS packets

CVE-2026-47183 · Severity: medium · CVSS 6.5 · Published 2026-07-17

Zeroconf is a Python library used by applications like Home Assistant to discover devices on a local network. A vulnerability in how the library logs errors allows an attacker on the same network to send specially crafted packets that cause the application to consume increasing amounts of memory. If left unchecked, this can lead to the application crashing or the entire system becoming unresponsive due to memory exhaustion.

Technologies: zeroconf (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-47183 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47183 being exploited in the wild.
How severe is CVE-2026-47183?
Medium severity, with a CVSS score of 6.5, published 17 July 2026.
Which products and versions are affected?
zeroconf (PyPI) < 0.149.6, ECOSYSTEM:introduced=0,fixed=0.149.6.
Is there a fix for CVE-2026-47183?
Yes. zeroconf (PyPI): upgrade to 0.149.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47183 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-47183?
Check whether you run zeroconf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • zeroconf (PyPI): upgrade to 0.149.6 or later
    pip install "zeroconf>=0.149.6"

Technical details

A vulnerability in python-zeroconf prior to version 0.149.6 stems from uncontrolled resource consumption (CWE-400) in the DNSIncoming._log_exception_debug and QuietLogger methods. These components stored an unbounded dictionary (_seen_logs) of exception messages. Because the exception messages for IncomingDecodeError include attacker-influenced data—such as the peer's source port, byte offsets, and pointer links—an attacker can generate a high volume of unique keys. Furthermore, the dictionary retained full sys.exc_info() tracebacks, which pinned raw packet buffers (up to ~9KB each) in memory. An unauthenticated attacker on the local link (UDP/5353) can exploit this to drive memory growth until the process is terminated by the OOM killer. The fix in 0.149.6 bounds the dictionary to 512 entries and stops retaining the traceback objects.

Affected products

  • python-zeroconf python-zeroconf < 0.149.6

Identifiers

  • CVE-2026-47183
  • GHSA-phvx-9mgw-67r5
  • PYSEC-2026-3437

Timeline

  • 2026-05-17: patched: Fix committed to repository
  • 2026-07-17: advisory: CVE-2026-47183 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.