CVE-2025-68471

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68471.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-617"
    ]
}

References

Affected packages

Git / github.com/avahi/avahi

Affected ranges

Type: GIT
Repo: https://github.com/avahi/avahi
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1

Affected versions

0.*

0.6.32-rc

v0.*

v0.6.23

v0.6.24

v0.6.25

v0.6.26

v0.6.27

v0.6.28

v0.6.29

v0.6.30

v0.6.31

v0.6.32

v0.7

v0.8

v0.9-rc1

v0.9-rc2

Database specific

vanir_signatures

[
    {
        "digest": {
            "function_hash": "285681115689231934736972820592826652179",
            "length": 761.0
        },
        "id": "CVE-2025-68471-8b800984",
        "signature_type": "Function",
        "source": "https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1",
        "deprecated": false,
        "target": {
            "function": "lookup_start",
            "file": "avahi-core/browse.c"
        },
        "signature_version": "v1"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "131477049406147028042511519061365218720",
                "69024678338108153641727758570983173709",
                "91183894014825058501342759438232662511",
                "263085132819081757133558578820548525645"
            ]
        },
        "id": "CVE-2025-68471-94d1d7b8",
        "source": "https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1",
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "avahi-core/browse.c"
        },
        "signature_version": "v1"
    }
]

vanir_signatures_modified

"2026-04-12T19:16:14Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68471.json"

Git / github.com/lathiat/avahi