CyberRota Analysis
AI-GeneratedThe vulnerability affects the Zeroconf multicast DNS service discovery implementation in versions prior to 0.149.12, where the AsyncListener improperly handles truncated queries, leading to potential memory exhaustion and increased CPU usage due to unbounded growth of deferred queries and timers. This allows unauthenticated local hosts to spoof requests, which can degrade performance and stability of the service. Organizations using affected versions should prioritize upgrading to version 0.149.12 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12.