CyberRota Analysis
AI-GeneratedThe vulnerability affects the Zeroconf library, specifically versions prior to 0.149.7, where the DNSCache component allows unauthenticated hosts to flood the cache with multicast DNS responses, leading to potential memory exhaustion and degraded performance of service discovery functionalities. This can result in slower cache lookups and disrupted service registration processes. Organizations using Zeroconf for service discovery should prioritize upgrading to version 0.149.7 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, slower async_expire passes, and broken discovery, registration, and ServiceBrowser callbacks. This issue is fixed in version 0.149.7.