python-zeroconf EUVD-2026-45248

The target must be running python-zeroconf (pip package zeroconf) in a version prior to 0.149.6 with an active mDNS listener bound to UDP/5353. The attacker must have Layer-2 network adjacency to the target - physically on the same LAN segment, same Wi-Fi SSID (without AP client isolation), same container bridge network, or same VLAN - because mDNS uses link-local multicast addresses (224.0.0.251 for IPv4, ff02::fb for IPv6) that do not traverse L3 routers. No authentication is required (CVSS PR:N) and no user interaction is needed (CVSS UI:N); the attack works against default configurations of any application using zeroconf for service discovery. Exploitation is limited by: (1) L2 adjacency requirement - internet-based remote exploitation is not possible; (2) Impact is pure availability - no confidentiality or integrity compromise is possible through this vulnerability; (3) Practical severity scales inversely with available RAM - well-resourced server deployments are significantly more resilient than embedded/IoT targets like Raspberry Pi; (4) The attack requires sustained traffic volume to produce OOM conditions, which may be detectable by network monitoring as anomalous mDNS flood from a single source.

The CVSS 6.5 score with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the risk profile: adjacent-only attack vector is the primary constraint, but 'adjacent' encompasses guest Wi-Fi, IoT VLANs, shared Docker bridge networks, and apartment Wi-Fi - a realistic threat surface for consumer and prosumer deployments. Attack complexity is genuinely low (no memory corruption, no timing dependency, no knowledge of internal state required - only the ability to send unique malformed UDP multicast packets). The CVSS availability impact of High is realistic for the canonical victim class (Home Assistant on Raspberry Pi with 1-4 GB RAM) but is less severe on well-provisioned servers. No EPSS score was included in the source data, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in CISA KEV and no public exploit code has been identified. Despite the moderate CVSS score, the deterministic exploitability (no randomness or guessing involved) and the zero-authentication, zero-interaction requirements mean any LAN-adjacent adversary can reliably trigger the condition. The lack of any in-process workaround - the vendor explicitly states upgrading is the only fix - elevates urgency for affected deployments.

An attacker on the same Wi-Fi network as a Home Assistant installation - such as a guest on an unisolated guest SSID, a compromised smart plug on the IoT VLAN, or a container on a shared Docker bridge - sends a continuous flood of malformed mDNS UDP packets to 224.0.0.251:5353, rotating source ports and label offsets across each packet to ensure each exception string is unique. Every packet causes zeroconf to insert a new entry into _seen_logs holding the full traceback and raw 8966-byte packet buffer; on a Raspberry Pi 4 with 2 GB RAM, saturating the dict with unique packets at LAN line rate exhausts available heap within minutes, triggering an OOM kill of the zeroconf process and disabling all HomeKit, Chromecast/Matter, and AirPlay discovery. No public exploit code has been identified in the source data, but the attack is mechanistically trivial given the fully public PR diff and issue tracker disclosure at https://github.com/python-zeroconf/python-zeroconf/issues/1714.