CVE-2026-47180Disclosure(paulsm / zeroconf)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5.

paulsm CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Other references

https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.5

Weakness type (CWE)

CWE-674

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

zeroconf

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
2 total mentions across 1 day

Affected systems

Vendors

paulsm

Products

zeroconf

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-47180 Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compres… https://www.cve.org/CVERecord?id=CVE-2026-47180 ----- Traducción: CVE-2026-47180 Zer… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑47180, a bug in Zeroconf’s multicast DNS implementation that occurs in versions prior to 0.149.5; it provides limited technical detail but no exploitation or patch information.
0000036
92 followersView on X
CVE@CVEnew92d
General
CVE-2026-47180 Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compres… https://www.cve.org/CVERecord?id=CVE-2026-47180
Post summary
The post merely references CVE‑2026‑47180 and its presence in a Python Zeroconf library, offering no exploits, PoC, or patch details.
00000650
57.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	paulsm	zeroconf	-	python	-

Explore more

Back to dashboard paulsm CVEs zeroconf vulnerabilities