SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-47180

MEDIUM · CVSS 6.5 EPSS 0.23% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-17 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The vulnerability affects the Zeroconf library, specifically in the DNSIncoming._decode_labels_at_offset function, which can lead to a RecursionError when processing mDNS packets with chained pointers. This flaw can result in sustained CPU usage, log flooding, and degraded performance of mDNS-dependent features for unauthenticated hosts on the local network. Organizations utilizing Zeroconf versions prior to 0.149.5 should prioritize updating to the latest version to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-47180
Severity
MEDIUM
CVSS
6.5
EPSS
0.23%

Original NVD Description

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5.