CVE-2026-47180
Received Received - Intake

Zeroconf DNS Name Compression RecursionError

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-18
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2026-47180
EUVD
EUVD-2026-45247

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zeroconf zeroconf to 0.149.5 (exc)
python zeroconf to 0.149.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in the python-zeroconf library caused by unbounded recursion in DNS compression-pointer decoding. A malicious mDNS packet with thousands of chained pointers triggers excessive recursion, bypassing Python's default limit. This leads to a RecursionError, causing CPU exhaustion, log flooding, and degraded mDNS-dependent services on the local network.

Detection Guidance

Monitor for excessive CPU usage or log flooding from mDNS traffic on UDP/5353. Check for malformed DNS packets with long compression pointer chains using packet inspection tools like tcpdump or Wireshark. Look for RecursionError logs in zeroconf service logs.

Impact Analysis

The impact includes sustained CPU usage, log flooding, and degraded performance of mDNS-dependent services like HomeKit, Chromecast, AirPlay, and printers. The attack requires only local network access, such as from a guest device or compromised IoT device, and can disrupt network functionality.

Compliance Impact

This vulnerability primarily impacts availability by causing CPU exhaustion and service degradation through crafted mDNS packets. It does not directly affect data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, prolonged service disruption could indirectly impact compliance by failing to maintain system availability for critical services.

Mitigation Strategies

Upgrade the python-zeroconf library to version 0.149.5 or later. Restrict mDNS traffic to trusted network segments using firewall rules. Monitor for suspicious mDNS traffic patterns indicating exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47180. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart