6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47184

CVE-2026-47184: zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood

Impact

DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache with no cap on entry count. The only pre-existing protection was a PTR TTL floor (_DNS_PTR_MIN_TTL = 1125 s, RFC 6762 §10), which actually prolonged attacker-injected records, and a periodic async_expire on _CACHE_CLEANUP_INTERVAL = 10 s that could not keep up with a flood.

Any unauthenticated host on the local link (UDP/5353, 224.0.0.251 / ff02::fb) can multicast valid mDNS responses with unique names (RFC 6762 §11 allows up to 253 bytes each) and watch them accumulate. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardware is the canonical victim) sustained traffic OOM-kills the process; under lighter load, every cache lookup and every periodic expiry pass grows linearly slower, starving asyncio and breaking unrelated zeroconf consumers (discovery, registration, ServiceBrowser callbacks). A second variant — re-multicasting cached records with shifting TTLs — grows _expire_heap unbounded between cleanup runs without touching cache or _total_records.

Patches

Fixed in zeroconf 0.149.6 (PR #1718). Upgrade to >= 0.149.6.

Workarounds

There is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP client isolation, guest-network separation, or host firewall rules.

Resources

PR #1718, fix
Issue #1715, public tracking issue
RFC 6762 §10, RFC 6762 §11, CWE-400

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47184

CVE-2026-47184:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
zeroconf	pip	< 0.149.7	0.149.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the zeroconf library's DNS cache mechanism, which failed to impose limits on the number of records it stored. The core of the issue is in the DNSCache._async_add method. This function, prior to being patched, would insert DNS records into the cache without any size restrictions. An unauthenticated attacker on the same local network could exploit this by sending a continuous flood of multicast DNS responses with unique names. Each of these responses would be added to the cache by _async_add, causing the application's memory usage to grow without bounds, eventually leading to a denial of service through memory exhaustion (OOM kill).

A second variant of the attack involved re-sending already cached records but with different TTL (Time-To-Live) values. This would cause the _expire_heap, a data structure used to manage record expirations, to grow indefinitely between cleanup cycles, even if the main cache size remained stable. This also leads to uncontrolled resource consumption.

The patch addresses these issues by introducing a hard cap on the total number of records (_MAX_CACHE_RECORDS) and implementing an eviction policy (_async_evict_oldest) within the _async_add function. When the cache is full, the oldest record is removed to make space for a new one. To counter the heap growth attack, a heap rebuilding mechanism (_maybe_rebuild_heap) was added, which is also called from within _async_add to keep the heap size in check. Therefore, DNSCache._async_add is the primary vulnerable function, and DNSCache.async_add_records is the public-facing method that orchestrates the addition of multiple records, making it a key function that would be observed during exploitation.

Vulnerable functions

DNSCache._async_add

src/zeroconf/_cache.py

This function is responsible for adding DNS records to the cache. Prior to the patch, it lacked a mechanism to limit the number of records, allowing an attacker on the local network to cause unbounded memory growth by sending a flood of mDNS responses. This would lead to a denial of service. The function was also vulnerable to a second variant of the attack where re-multicasting cached records with shifting TTLs would cause the `_expire_heap` to grow unbounded.

DNSCache.async_add_records

src/zeroconf/_cache.py

This function serves as the entry point for adding multiple DNS records to the cache. It iterates over the provided records and calls the vulnerable `_async_add` function for each, making it a key part of the exploitation process that would appear in a runtime profile.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.