CVE-2026-24401
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Avahi in versions 0.9rc2 and below allows crashing avahi-daemon via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record where the alias and canonical name point to the same domain. This causes unbounded recursion in lookup_handle_cname and stack exhaustion. The vulnerability affects record browsers with AVAHI_LOOKUP_USE_MULTICAST explicitly set, including those created by resolvers used by nss-mdns.
Risk Assessment
An attacker on the local network can remotely crash the avahi-daemon service, disrupting mDNS/DNS-SD name resolution and causing denial of service. This may impact services relying on local network discovery.
Recommendation
Upgrade Avahi to version 0.9-rc3 or later containing the fix from commit 78eab31128479f06e30beb8c1cbf99dd921e2524. Until then, consider limiting mDNS service exposure on the local network.
Other vulnerabilities in Avahi
See all- CVE-2026-34933Medium
Avahi, a system for service discovery on a local network via mDNS/DNS-SD, prior to version 0.9-rc4 is vulnerable to a DoS attack. Any unprivileged local user can send a single D-Bus method call with conflicting publish flags, causing avahi-daemon to crash.
- CVE-2025-59529Medium
A vulnerability in Avahi (up to and including 0.9-rc5) allows the simple protocol server to ignore the documented client limit (CLIENTS_MAX) and accept unlimited connections. This enables unprivileged local users to exhaust daemon memory and file descriptors, causing a local denial of service (DoS). No official patched version is available, but a candidate fix exists in pull request 808.
- CVE-2023-38473Medium
A vulnerability exists in Avahi where a reachable assertion occurs in the avahi_alternative_host_name() function. Malformed input can cause the Avahi daemon to abort.
- CVE-2023-38472Medium
A vulnerability exists in Avahi where a reachable assertion occurs in the avahi_rdata_parse() function. Crafted DNS records can cause the daemon to abort.
- CVE-2023-38471Medium
A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
- CVE-2023-38470Medium
A vulnerability exists in Avahi where a reachable assertion occurs in the avahi_escape_label() function. Malformed input can cause the daemon to abort.
- CVE-2023-38469Medium
A vulnerability exists in Avahi where a reachable assertion occurs in avahi_dns_packet_append_record. Crafted DNS packets can cause the daemon to abort.
Original NVD description (English source)
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS