VulnSocial

CVE-2026-48045Disclosure(paulsm / zeroconf)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12.

paulsm CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • zeroconf

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
paulsm
Products
zeroconf

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-17: 2Technical Details · 2026-07-17: 207-17
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-48045 Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit in… https://www.cve.org/CVERecord?id=CVE-2026-48045 ----- Traducción: CVE-2026-48045 Zer… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-48045 and provides a brief technical detail, linking to the official CVE record, but offers no PoC, exploit, patch, or exploitation claim.

    0000037
    92 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-48045 Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit in… https://www.cve.org/CVERecord?id=CVE-2026-48045

    Post summary

    The statement announces CVE-2026-48045, noting a bug in the Zeroconf Python library where truncated TC-bits are incorrectly preserved in multicast DNS packet handling.

    00000695
    57.8K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apppaulsmzeroconf-python-

Explore more

Back to dashboardpaulsm CVEszeroconf vulnerabilities