CLSA-2026-1786027278 avahi: Fix of 4 CVEs

CVE-2025-68468: fix remote denial of service via crafted mDNS CNAME announcements assertion failure in lookupmulticastcallback - CVE-2025-68471: fix remote denial of service via unsolicited CNAME announcements assertion failure in lookupstart - CVE-2025-68276: fix local denial of service via...

SUSE-SU-2026:21445-1 Security update for avahi

This update for avahi fixes the following issues: - CVE-2025-68276: reachable assertion in avahiwideareascancache can lead to an avahi-daemon crash bsc1256498. - CVE-2025-68468: reachable assertion in lookupmulticastcallback can lead to an avahi-daemon crash bsc1256499. - CVE-2025-68471: reachabl...

Avahi has a reachable assertion in lookup_start

...

CVE-2025-68471 Avahi has a reachable assertion in lookup_start

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart...

CVE-2025-68471

CVE-2025-68471 affects Avahi (0.9-rc2 and earlier) and is triggered by processing two unsolicited announcements with CNAME records, leading to a crash/DoS via a reachable assertion in lookup_start. Connected advisories indicate fixes in avahi packages (e.g., openSUSE/SUSE advisories;Mariner notes...