CyberRota Analysis
AI-GeneratedThe vulnerability affects the Zeroconf library, specifically in the DNSIncoming._decode_labels_at_offset function, which can lead to a RecursionError when processing mDNS packets with chained pointers. This flaw can result in sustained CPU usage, log flooding, and degraded performance of mDNS-dependent features for unauthenticated hosts on the local network. Organizations utilizing Zeroconf versions prior to 0.149.5 should prioritize updating to the latest version to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5.