CVE-2026-34933

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34933
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34933.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34933
Aliases
  • GHSA-w65r-6gxh-vhvc
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CGA (4)
CLSA (3)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (1)
OESA (6)
openSUSE (2)
RHSA (1)
ROOT (2)
SUSE (7)
UBUNTU (1)
Related
openSUSE (2)
SUSE (7)
Published
2026-04-03T22:43:26Z
Modified
2026-10-28T02:30:27Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon
Details

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-617"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34933.json"
}
References

Affected packages

Git / github.com/avahi/avahi

Affected ranges

Type
GIT
Repo
https://github.com/avahi/avahi
Events
Introduced
8ee3bd6f7921b489bde14f120187a5becf134d30
Fixed
625ca0fac19229f6dfa3a6c6b698ae657187e50c
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:avahi:avahi:0.9:rc1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0.9-rc1"
                },
                {
                    "last_affected": "0.9-rc1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:avahi:avahi:0.9:rc2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0.9-rc2"
                },
                {
                    "last_affected": "0.9-rc2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:avahi:avahi:0.9:rc3:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0.9-rc3"
                },
                {
                    "last_affected": "0.9-rc3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "range": [
                {
                    "fixed": "625ca0fac19229f6dfa3a6c6b698ae657187e50c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.9-rc1
0.9-rc2
0.9-rc3
v0.*
v0.9-rc1
v0.9-rc2
v0.9-rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34933.json"