openSUSE-SU-2026:21175-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21175-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/openSUSE-SU-2026:21175-1
- Upstream
- Related
- Published
- 2026-06-30T09:08:26Z
- Modified
- 2026-07-02T18:24:18Z
- Summary
- Security update for python-zeroconf
- Details
-
This update for python-zeroconf fixes the following issues:
Changes in python-zeroconf:
- CVE-2026-47180: zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service (bsc#1268341)
- CVE-2026-47183: zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion (bsc#1268342)
- CVE-2026-47184: zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood (bsc#1268343)
- CVE-2026-48045: python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood (bsc#1268388)
- CVE-2026-48487: python-zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet (bsc#1268235)
- References
-
- https://bugzilla.suse.com/1268235
- https://bugzilla.suse.com/1268341
- https://bugzilla.suse.com/1268342
- https://bugzilla.suse.com/1268343
- https://bugzilla.suse.com/1268388
- https://www.suse.com/security/cve/CVE-2026-47180
- https://www.suse.com/security/cve/CVE-2026-47183
- https://www.suse.com/security/cve/CVE-2026-47184
- https://www.suse.com/security/cve/CVE-2026-48045
- https://www.suse.com/security/cve/CVE-2026-48487