Executive brief
The python-zeroconf library, used for automatic device discovery on local networks, is vulnerable to a denial-of-service attack. An attacker on the same local network can send a flood of specially crafted network traffic that causes the application to consume excessive memory and processor power. This can lead to the application crashing or becoming completely unresponsive, disrupting services that rely on automatic network discovery.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in the AsyncListener.handle_query_or_defer component of python-zeroconf. The implementation failed to cap the number of deferred truncated (TC-bit) queries stored in memory or the number of distinct source addresses tracked. An attacker on the local link (UDP/5353) can send a stream of byte-distinct TC-flagged queries with spoofed source IPs to grow internal dictionaries (_deferred and _timers) without limit. This results in memory exhaustion (OOM) and quadratic CPU burn during the O(N) deduplication scan of the deferred list. The issue is resolved in version 0.149.12 by implementing per-address and total-address caps with FIFO eviction.
Affected products
- python-zeroconf python-zeroconf < 0.149.12
Timeline
- 2026-05-20: patched: Fix committed and version 0.149.12 released.
- 2026-05-21: advisory: GitHub Security Advisory GHSA-9663-mqmp-p9mm published.
- 2026-07-17: disclosed: CVE-2026-48045 published to NVD.
References
- https://github.com/python-zeroconf/python-zeroconf/commit/b22c8ff19c66c68907d220a4823c0950f4fa93f7
- https://github.com/python-zeroconf/python-zeroconf/pull/1751
- https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.12
- https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9663-mqmp-p9mm