CVE-2026-34933
Denial of Service in Avahi-daemon via D-Bus Method Call
Publication date: 2026-04-03
Last updated on: 2026-04-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| avahi | avahi | to 0.9 (exc) |
| avahi | avahi | 0.9 |
| avahi | avahi | 0.9 |
| avahi | avahi | 0.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-617 | The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Avahi, a system that facilitates service discovery on a local network using the mDNS/DNS-SD protocol suite. Before version 0.9-rc4, any unprivileged local user could cause the avahi-daemon to crash by sending a single D-Bus method call with conflicting publish flags.
The issue was fixed in version 0.9-rc4.
How can this vulnerability impact me? :
The vulnerability allows an unprivileged local user to crash the avahi-daemon, which can lead to a denial of service condition on the affected system.
The CVSS score of 5.5 indicates a medium severity impact, specifically causing availability issues without affecting confidentiality or integrity.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update avahi-daemon to version 0.9-rc4 or later, as this version contains the patch that fixes the issue.
Since the vulnerability allows any unprivileged local user to crash avahi-daemon by sending a crafted D-Bus method call, restricting local user access or monitoring for unusual crashes may help as temporary measures until the update is applied.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unprivileged local user to crash the avahi-daemon by sending a specially crafted D-Bus method call. The impact is a denial of service (availability) without affecting confidentiality or integrity.
Since the vulnerability does not lead to unauthorized access, data leakage, or modification, it does not directly impact compliance with data protection regulations such as GDPR or HIPAA, which primarily focus on confidentiality and integrity of personal or health data.
However, the denial of service could affect system availability, which may be a consideration under some regulatory frameworks that require systems to be resilient and available.