CVE-2026-47180: Zeroconf Denial of Service Vulnerability
MODERATECVE-2026-47180 is a MODERATE (CVSS 6.5) denial of service vulnerability (CWE-674: Uncontrolled Recursion) affecting Zeroconf libraries in the PyPI ecosystem. The issue involves zeroconf has unbounded recursion in dns compression-pointer decoder that allows lan-local denial of service. Remediation is available by upgrading affected packages to version 0.149.5.
CVE-2026-47180 at a Glance
Security Impact
CVSS: 6.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix CVE-2026-47180
To remediate this vulnerability, upgrade all affected Zeroconf dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install zeroconf>=0.149.5Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show zeroconfHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2026-47180, inspect your installed packages using pip:
pip show zeroconfAnalyze the terminal output to locate any version of Zeroconf in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.149.5), your application is affected.
Note: The pip show zeroconf command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-674: Uncontrolled Recursion, where the product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. In Zeroconf, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-47180 Affected Zeroconf Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
zeroconf
|
PyPI |
< 0.149.5
|
0.149.5
|
References
Frequently Asked Questions
What is CVE-2026-47180?
Which Zeroconf versions are affected?
What version fixes CVE-2026-47180?
Is zeroconf affected?
What is the CVSS score of CVE-2026-47180?
What CWE is associated with CVE-2026-47180?
How can I check PyPI dependencies for CVE-2026-47180?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-9pgc-3ccv-5297",
"modified" : "2026-05-29T20:09:52Z",
"published" : "2026-05-29T20:09:52Z",
"aliases" : [ "CVE-2026-47180" ],
"summary" : "zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service",
"details" : "### Impact\n\n`DNSIncoming._decode_labels_at_offset` recurses once per DNS-name compression pointer (RFC 1035 §4.1.4). Pointer cycles and label counts were capped, but the chain length of unique forward pointers was not. A single ~3 kB mDNS packet carrying ~1500 chained pointers drives the recursion past CPython's default limit, and `RecursionError` was not listed in `DECODE_EXCEPTIONS`, so it escaped `DNSIncoming.__init__` and was logged by asyncio's default exception handler.\n\nAny unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can degrade the mDNS listener; that includes a guest on the same Wi-Fi, a compromised IoT device, or a container on a shared bridge. Replaying at a few hertz produces sustained CPU burn and log flooding, and mDNS-dependent features (HomeKit, Chromecast/Matter, AirPlay, printers) degrade while the attack is in flight.\n\n### Patches\nFixed in `zeroconf` 0.149.5 ([PR #1719](https://github.com/python-zeroconf/python-zeroconf/pull/1719)).\nUpgrade to `>= 0.149.5`.\n\n### Workarounds\nThere is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP client isolation, guest-network separation, or host firewall rules.\n\n### Resources\n- [PR #1719](https://github.com/python-zeroconf/python-zeroconf/pull/1719), fix\n- [Issue #1713](https://github.com/python-zeroconf/python-zeroconf/issues/1713), public tracking issue\n- [RFC 1035 §4.1.4](https://www.rfc-editor.org/rfc/rfc1035#section-4.1.4), [RFC 6762](https://www.rfc-editor.org/rfc/rfc6762), [CWE-674](https://cwe.mitre.org/data/definitions/674.html)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "zeroconf"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.149.5"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9pgc-3ccv-5297"
}, {
"type" : "WEB",
"url" : "https://github.com/python-zeroconf/python-zeroconf/issues/1713"
}, {
"type" : "WEB",
"url" : "https://github.com/python-zeroconf/python-zeroconf/pull/1719"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/python-zeroconf/python-zeroconf"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-674" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-05-29T20:09:52Z",
"nvd_published_at" : null
}
}