zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion
Impact
DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dict keyed by str(sys.exc_info()[1]). The seven IncomingDecodeError messages raised from _read_name / _decode_labels_at_offset (RFC 6762 §18 name-decoding error paths) all embed self.source — the peer's ephemeral source port, varying per packet — plus byte offset and pointer link, so every attacker-influenced combination produced a fresh dedup key. The stored value was the full sys.exc_info() triple, whose traceback's frame locals retained self.data (the raw inbound packet, up to 8966 bytes per RFC 6762 §17). Each unique malformed packet therefore pinned ~9 KB until process exit.
Any unauthenticated host on the local link (UDP/5353, 224.0.0.251 / ff02::fb) can drive memory growth at line rate; that includes a guest on the same Wi-Fi, a compromised IoT device, or a container on a shared bridge. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardware is the canonical victim) sustained traffic trivially OOM-kills the process, and mDNS-dependent features (HomeKit, Chromecast/Matter, AirPlay, printers) degrade or fail.
Patches
Fixed in zeroconf 0.149.6 (PR #1717). Upgrade to >= 0.149.6.
Workarounds
There is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP client isolation, guest-network separation, or host firewall rules.
Resources
- PR #1717, fix
- Issue #1714, public tracking issue
- RFC 6762 §17, RFC 6762 §18, CWE-400
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | zeroconf | < 0.149.6 | 0.149.6 |
References
- https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-phvx-9mgw-67r5
- https://github.com/python-zeroconf/python-zeroconf/issues/1714
- https://github.com/python-zeroconf/python-zeroconf/pull/1717
- https://github.com/python-zeroconf/python-zeroconf
- https://pypi.org/project/zeroconf
- https://github.com/advisories/GHSA-phvx-9mgw-67r5
- https://nvd.nist.gov/vuln/detail/CVE-2026-47183
- CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-400- Platform
- Python (PyPI)
- Package
zeroconf- Disclosed
- 29.05.2026
- Updated
- 11.10.2026 14:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3437 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-phvx-9mgw-67r5 - CC BY 4.0
Vulnerability history: zeroconf
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 05.2026 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 5
Disclosures per year
- 2026: 5
-
zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.