Executive brief
Zeroconf is a Python library used by applications like Home Assistant to discover devices on a local network. A vulnerability in how the library logs errors allows an attacker on the same network to send specially crafted packets that cause the application to consume increasing amounts of memory. If left unchecked, this can lead to the application crashing or the entire system becoming unresponsive due to memory exhaustion.
Technical details
A vulnerability in python-zeroconf prior to version 0.149.6 stems from uncontrolled resource consumption (CWE-400) in the DNSIncoming._log_exception_debug and QuietLogger methods. These components stored an unbounded dictionary (_seen_logs) of exception messages. Because the exception messages for IncomingDecodeError include attacker-influenced data—such as the peer's source port, byte offsets, and pointer links—an attacker can generate a high volume of unique keys. Furthermore, the dictionary retained full sys.exc_info() tracebacks, which pinned raw packet buffers (up to ~9KB each) in memory. An unauthenticated attacker on the local link (UDP/5353) can exploit this to drive memory growth until the process is terminated by the OOM killer. The fix in 0.149.6 bounds the dictionary to 512 entries and stops retaining the traceback objects.
Affected products
- python-zeroconf python-zeroconf < 0.149.6
Timeline
- 2026-05-17: patched: Fix committed to repository
- 2026-07-17: advisory: CVE-2026-47183 published
References
- https://github.com/python-zeroconf/python-zeroconf/commit/95561e28b24922358f1991e38e3a86d70d72dcec
- https://github.com/python-zeroconf/python-zeroconf/issues/1714
- https://github.com/python-zeroconf/python-zeroconf/pull/1717
- https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.6
- https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-phvx-9mgw-67r5