Vulnerabilities for zeroconf

First version without a known vulnerability: 0.149.16

Details

• GHSA-qc2x-6f54-m6h92026-06-22

  zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet

  Fixed in: 0.149.16

• GHSA-9663-mqmp-p9mm2026-06-11

  python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

  Fixed in: 0.149.12

• GHSA-rfg2-pjw2-56x22026-05-29

  zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood

  Fixed in: 0.149.7

• GHSA-phvx-9mgw-67r52026-05-29

  zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion

  Fixed in: 0.149.6

• GHSA-9pgc-3ccv-52972026-05-29

  zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service

  Fixed in: 0.149.5