Is there a patch available for CVE-2026-48487?

Yes, a patch is available for CVE-2026-48487. Update the affected software to the latest version immediately.

python-zeroconf CVE-2026-48487

Q: What is the CVSS score of CVE-2026-48487?

CVE-2026-48487 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45252 MEDIUM

Improper Handling of Length Parameter Inconsistency (CWE-130)

2026-06-22 https://github.com/python-zeroconf/python-zeroconf

GHSA-qc2x-6f54-m6h9 PYSEC-2026-3438

Python Information Disclosure

5.3

CVSS 4.0 · Vendor: https://github.com/python-zeroconf/python-zeroconf

Severity by source

Vendor (https://github.com/python-zeroconf/python-zeroconf) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Adjacent multicast vector with no authentication or user interaction; I:H reflects full cache poisoning; no confidentiality or availability impact confirmed.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/python-zeroconf/python-zeroconf).

CVSS VectorVendor: https://github.com/python-zeroconf/python-zeroconf

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 17, 2026 - 19:22 NVD

6.5 (MEDIUM) 5.3 (MEDIUM)

Source Code Evidence Fetched

Jun 22, 2026 - 23:31 vuln.today

Analysis Generated

Jun 22, 2026 - 23:31 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 pypi packages depend on zeroconf (3 direct, 3 indirect)

Ecosystem-wide dependent count for version 0.149.16.

DescriptionCVE.org

Impact

_read_character_string and _read_string in src/zeroconf/_protocol/incoming.py sliced self.data[self.offset : self.offset + length] and advanced self.offset by the declared length without checking it against self._data_len. Python's slice silently returns fewer bytes when the end index runs past the buffer, so a record whose 16-bit RDLENGTH (RFC 1035 §3.2.1) over-advertised by tens of kilobytes was constructed from a truncated payload, appended to DNSIncoming._answers, and committed to the cache before any later parse failure surfaced. The follow-up _read_name for the next record then failed, but the corrupt record had already entered the answer list and propagated to DNSCache and ServiceInfo.

Any unauthenticated host on the local link (UDP/5353, 224.0.0.251 / ff02::fb) can multicast a single mDNS response carrying a TXT, HINFO, or A/AAAA record that advertises rdlength=65535 and only a handful of real payload bytes; consumers calling ServiceInfo.properties then parse the truncated bytes as if they matched the wire, and downstream integrations (Home Assistant and other zeroconf-driven discovery) trust the decoded record. The bug is parser-state desync rather than RCE, but it seeds the cache with attacker-shaped key/value and address records for a TTL window and is a building block for higher-impact chains.

The impact is likely lower than the other recently released advisories as there is no additional risk of OOM so the severity was manually set to low to override the score CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (6.5, Medium) since that doesn't fully consider the mDNS threat model.

Patches

Fixed in zeroconf 0.149.16 (PR #1756). Note that this change originally intended to ship in 0.149.13 but we ran out of space on PyPI: see https://github.com/python-zeroconf/python-zeroconf/issues/1769

Upgrade to >= 0.149.16.

Workarounds

There is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP client isolation, guest-network separation, or host firewall rules.

Resources

AnalysisAI

Cache poisoning in python-zeroconf before 0.149.16 allows any unauthenticated adjacent-network attacker to inject attacker-controlled DNS records into the local mDNS cache by multicasting a single crafted UDP packet on port 5353. The parser in _read_character_string and _read_string advanced its offset by a caller-declared length without validating it against the actual packet buffer size; Python's silent slice truncation meant over-advertised records were accepted and committed to DNSCache and ServiceInfo intact. The vendor manually downgraded severity to low, noting no RCE or OOM risk, but characterizes this as a building block for higher-impact chains in downstream consumers such as Home Assistant. No public exploit code has been identified and the vulnerability is not in CISA KEV.

Technical ContextAI

The affected library is the Python zeroconf package (pkg:pip/zeroconf), which implements multicast DNS (mDNS, RFC 6762) and DNS-SD for zero-configuration service discovery. The vulnerable code in src/zeroconf/_protocol/incoming.py reads a 16-bit RDLENGTH field from the wire (per RFC 1035 §3.2.1) and immediately uses it as a slice bound without checking self.offset + length <= self._data_len. Python's slice semantics silently return a shorter sequence when the end index exceeds the buffer, so the parser accepted a truncated record, advanced its state pointer by the full declared length, and stored the corrupt record in DNSIncoming._answers before propagating it to DNSCache and ServiceInfo. This matches CWE-130 (Improper Handling of Length Parameter Inconsistency), where an externally supplied length value is trusted without verification against the actual data boundary. The fix in PR #1756 adds explicit bounds checks raising IncomingDecodeError and a per-record resync that drops any record whose consumed byte count differs from its declared rdlength.

RemediationAI

Upgrade python-zeroconf to version 0.149.16 or later; this is the only code-level fix and no in-process workaround exists. The patched release adds buffer bounds validation in _read_character_string and _read_string and drops records that do not consume exactly their declared rdlength. The patch is available at https://github.com/python-zeroconf/python-zeroconf/pull/1756. As a network-layer compensating control where immediate upgrade is not possible, restrict mDNS traffic (UDP/5353, multicast groups 224.0.0.251 and ff02::fb) to trusted Layer-2 segments using AP client isolation, guest-network VLAN separation, or host-based firewall rules blocking inbound UDP/5353 from untrusted sources. This prevents an untrusted host from reaching the multicast group but does not address the parser flaw, and will disrupt legitimate mDNS service discovery as a trade-off.