python-zeroconf EUVD-2026-45249

Exploitation requires network adjacency: the attacker must be on the same Layer-2 broadcast domain (same Wi-Fi SSID/BSSID, VLAN, or Ethernet collision domain) as the target host, since mDNS operates on link-local multicast addresses (224.0.0.251 for IPv4, ff02::fb for IPv6) that are not forwarded by Layer-3 routers. The CVSS vector confirms no authentication is required (PR:N) and no user interaction is needed (UI:N). No special software configuration is required beyond the default listener state - any deployment of python-zeroconf that processes incoming mDNS responses is affected in its default configuration, which includes standard Home Assistant installations. Severity is amplified on memory-constrained hardware: Raspberry Pi-class devices face OOM-kill under sustained flood, while well-resourced hosts experience asyncio starvation and degraded mDNS service discovery. The TTL-replay heap-bloat variant operates independently of the entry-count cap and does not require the attacker to exceed any single record threshold, making it viable as a slower, stealthier degradation technique. Exploitation is limited to availability impact only; no data exfiltration or integrity manipulation is achievable through this vector.

The CVSS 6.5 score and AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector accurately characterize realistic risk. The adjacent network vector (AV:A) is the dominant limiting factor: exploitation is confined to the attacker's Layer-2 broadcast domain, eliminating remote internet-based attacks. Within that constraint, complexity is low and no privileges are required, making the attack trivially executable by any device on the same Wi-Fi or Ethernet segment - a realistic threat model in shared residential or IoT environments. The availability impact is disproportionately severe on memory-constrained embedded hardware: the advisory explicitly identifies Home Assistant on Raspberry Pi-class devices as the canonical victim, where sustained flooding produces OOM-kill and full process termination. On better-resourced hosts, degradation manifests as linear slowdown in cache lookups and asyncio starvation that breaks service discovery and ServiceBrowser callbacks - still a meaningful operational impact. No EPSS data was provided; no CISA KEV listing and no confirmed public exploit code exist at time of analysis, placing the current exploitation status as theoretical but credible given the simplicity of the required mDNS flood. The Canonical tag indicates downstream Ubuntu/Debian packaging relevance, potentially broadening the affected install base beyond direct pip users. The two structurally distinct attack variants documented in the advisory suggest careful pre-disclosure analysis and increase confidence that the vulnerability class is well-understood and exploitable without specialized tooling.

An attacker with a laptop or IoT device connected to the same Wi-Fi network as a Home Assistant instance on a Raspberry Pi multicasts a continuous stream of syntactically valid mDNS response packets to UDP/5353 (224.0.0.251), each advertising a distinct 253-byte hostname per RFC 6762 §11. The python-zeroconf DNSCache accumulates these records across all four internal structures - cache, _expirations, _expire_heap, and service_cache - faster than the 10-second cleanup interval can drain them, exhausting the Raspberry Pi's limited RAM within minutes and triggering an OOM-kill of the Home Assistant process. As a lower-noise alternative, the attacker replays cached mDNS records with incrementally shifted TTLs, bloating _expire_heap with stale duplicate tuples independently of the cache entry counter, producing progressive asyncio starvation and degraded service discovery without the abrupt crash signature of the flood variant. No public exploit code is identified at time of analysis.