python-zeroconf CVE-2026-48045

The attacker must be on the same Layer-2 network segment as the target host, or able to inject UDP packets to the mDNS multicast addresses 224.0.0.251 (IPv4) or ff02::fb (IPv6) on port 5353. No authentication is required - mDNS is an unauthenticated protocol by design (CVSS PR:N confirmed). No non-default configuration is necessary: any host running python-zeroconf below 0.149.12 with an active mDNS listener is vulnerable in its default state. Source IP spoofing on UDP is trivial and amplifies the attack by multiplying distinct addr keys in _deferred and _timers. Exploitation is limited by the adjacent-network attack vector (AV:A) - the attacker cannot reach the target from the public internet without first obtaining LAN presence or the ability to route/tunnel multicast traffic. Impact is strictly availability (OOM-kill or event-loop starvation); there is no confidentiality or integrity exposure.

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 6.5) accurately characterizes this vulnerability. The adjacent-network attack vector is the primary exploitability constraint - an attacker must be on the same Layer-2 segment or able to inject UDP traffic into the mDNS multicast domain, which is a meaningful barrier compared to internet-facing vulnerabilities. However, the CVSS vector does not capture the spoofing amplification: since UDP/5353 carries no source authentication, a single LAN-adjacent attacker can trivially generate hundreds of distinct source IPs, multiplying the _deferred/_timers table size far beyond what a single legitimate address would cause. Availability impact is rated High and is realistic - the advisory explicitly names OOM-kill on memory-constrained hardware as the primary outcome. No EPSS data was provided in the input, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. Given that mDNS is enabled by default on all deployments, that no special configuration is required to be vulnerable, and that Home Assistant on Raspberry Pi is a widely deployed target class, the real-world risk for IoT and home-automation environments is elevated relative to the moderate CVSS score. The confidentiality and integrity impact are confirmed nil - this is a pure availability attack with no data exfiltration path.

An attacker on the same LAN segment uses a packet-crafting tool to emit a high-rate stream of TC-flagged mDNS query packets addressed to 224.0.0.251:5353, each with a distinct byte payload and spoofed source IP from a rotating pool. Each spoofed source creates a new _deferred and _timers entry retaining up to ~9 KB of state; as the dictionary grows, the O(N) per-arrival dedup scan increasingly monopolizes the asyncio event loop. On a Raspberry Pi 4 running Home Assistant with python-zeroconf below 0.149.12, sustained flood traffic (achievable from a single LAN-connected laptop) causes the Python process to be OOM-killed by the kernel within seconds to minutes; no public exploit code exists for this CVE at time of analysis.