CyberRota Analysis
AI-GeneratedThe Zeroconf library prior to version 0.149.16 is vulnerable to a denial-of-service attack, where unauthenticated local hosts can exploit the _read_character_string and _read_string functions to manipulate memory offsets, potentially leading to truncated and maliciously crafted DNS records. This vulnerability can compromise the integrity of DNSCache and ServiceInfo properties, allowing attackers to disrupt service discovery on local networks. Organizations using Zeroconf for service discovery should prioritize upgrading to version 0.149.16 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.