cupshax

CUPSHax Quick proof of concept for the recent CUPS exploit. I was planning to clean it up a lot more, but the embargo was lifted a lot sooner than expected, so the code is a bit rushed. For all the technical details you should honestly just read Evilsocket's writeup. This exploit was written afte...

[SECURITY] Fedora 45 Update: kdnssd-26.08.2-1.fc45

KDE Network Monitor for DNS-SD services Zeroconf...

Exploit for CVE-2026-112325

CVE-2026-112325 — NULL-Pointer Dereference in OpenThread mDNS...

CentOS Linux 7 [TuxCare] Security Update: avahi / avahi-autoipd / avahi-compat-howl / avahi-compat-howl-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1786027278)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1786027278 advisory. - Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, a...

AlmaLinux 9.2 [TuxCare] Security Update: avahi / avahi-autoipd / avahi-compat-howl / avahi-compat-howl-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786360814)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786360814 advisory. - Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and...

mDNS Amplification Attack Vector Detection

Sends a unicast mDNS PTR query for services.dns-sd.udp.local and checks whether the response is more than twice the request size, indicating the service can be abused for UDP amplification / reflection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect mDNS UDP amplification response...

Matter device inventory

Full Matter node inventory from DNS-SD TXT vendor/product, device type, commissioning window, discriminator with optional JSON export. !/usr/bin/env python3 -- coding: utf-8 -- """Matter device inventory dump JSON via session or target.""" from kittysploit import from lib.protocols.matter.client...

Matter discover

Browse Matter commissionable/operational DNS-SD records and summarize vendor, device type, and commissioning mode session preferred. !/usr/bin/env python3 -- coding: utf-8 -- """Matter mDNS discovery via session or target.""" from kittysploit import from lib.protocols.matter.client import...

mDNS / DNS-SD Enum

Enumerates DNS-SD instances via unicast or multicast mDNS, resolves PTR→SRV/TXT/A, and suggests KittySploit protocol sessions. !/usr/bin/env python3 -- coding: utf-8 -- """Deep mDNS / DNS-SD enumeration with SRV/TXT/A correlation and module handoff.""" from kittysploit import from...

mDNS / DNS-SD Detection

Queries DNS-SD over unicast or multicast mDNS UDP 5353. In typed mode, probes IoT service types and suggests KittySploit follow-up modules. !/usr/bin/env python3 -- coding: utf-8 -- """Detect mDNS / DNS-SD responders and map IoT service types to modules.""" from kittysploit import from...

EulerOS 2.0 SP11 : avahi (EulerOS-SA-2026-2235)

According to the versions of the avahi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below,...

CVE-2026-35659

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious...

CVE-2026-35659: Insufficient Verification of Data Authenticity

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious...

External Control of Critical State Data

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to External Control of Critical State Data in the CLI routing process after failed service resolution, where Bonjour and DNS-SD TXT metadata could still influence the chosen target. An...

PT-2026-30544

Summary Bonjour and DNS-SD TXT metadata could still steer CLI routing even when actual service resolution failed, allowing unresolved hints to influence the chosen target. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...

CVE-2026-26327

OpenClaw is a personal AI assistant. Discovery beacons Bonjour/mDNS and DNS-SD include TXT records such as "lanHost", "tailnetDns", "gatewayPort", and "gatewayTlsSha256". TXT records are unauthenticated. Prior to version 2026.2.14, some clients treated TXT values as authoritative routing/pinning...

CVE-2026-26327: Insufficient Verification of Data Authenticity

OpenClaw is a personal AI assistant. Discovery beacons Bonjour/mDNS and DNS-SD include TXT records such as lanHost, tailnetDns, gatewayPort, and gatewayTlsSha256. TXT records are unauthenticated. Prior to version 2026.2.14, some clients treated TXT values as authoritative routing/pinning inputs...

CVE-2025-68471

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart...

CVE-2025-68471 Avahi has a reachable assertion in lookup_start

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart...

CVE-2025-68468

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they...