CVE-2011-1002

Avahi CVE-2011-1002 affects the avahi-daemon (avahi) before 0.6.29. A remote attacker can trigger a denial of service (infinite loop) by sending an empty mDNS UDP packet to port 5353 (IPv4 or IPv6). The issue arises from an incorrect fix related to CVE-2010-2244. Public advisories and distributio...

CVE-2021-3468

CVE-2021-3468 affects the Avahi package: versions 0.6 through 0.8 contain a flaw where the event signaling termination of a client connection on the Avahi Unix socket is mishandled in client_work, allowing a local attacker to trigger an infinite loop. The primary impact is availability, with the ...

CVE-2023-38473

CVE-2023-38473 affects Avahi; a reachable assertion in avahi_alternative_host_name() is the root cause. Public advisories indicate this vulnerability impacts Avahi components and has a high availability impact (per CVSS qualifiers). Debian LTS advisory DLA-3990-1 lists CVE-2023-38473 among fixed ...

CVE-2023-38469

The CVE-2023-38469 issue affects Avahi and stems from a reachable assertion in avahi_dns_packet_append_record. The connected documents confirm Avahi-related advisories across multiple distributions, indicating this is a real vulnerability with measurable impact (availability can be affected). Pub...

CVE-2023-38470

CVE-2023-38470 — Avahi reachable assertion in avahi_escape_label() has concrete public details in multiple connected documents. Affected software is Avahi (DNS-SD/ZeroConf daemon); the issue is a reachable assertion inside the avahi_escape_label() function. Reported impact in the primary CVE entr...

CVE-2023-38471

CVE-2023-38471 affects Avahi, specifically a reachable assertion in dbus_set_host_name. Connected advisories confirm Avahi as the affected software and cite a fix in newer package releases (e.g., Debian LTS advisory DLA-3990-1 upgrading avahi to >= 0.8-5+deb11u3; Mariner entries reference vers...

CVE-2023-38472

CVE-2023-38472 affects Avahi, with a reachable assertion in avahi_rdata_parse. The vulnerability is reported to allow local access vectors and a high availability impact, scored up to 6.2 (CVSSv3.1, MEDIUM). Affected releases include Avahi where patches exist (per Debian, AlmaLinux, and Amazon Li...

CVE-2017-6519

The CVE-2017-6519 issue affects avahi-daemon in Avahi up to versions 0.6.32/0.7, where IPv6 unicast queries can yield responses with non-on-link source addresses, enabling a remote attacker to cause a Denial of Service (traffic amplification) and potentially leak information via UDP 5353. Public ...

CVE-2021-26720

CVE-2021-26720 affects the Debian avahi package (up to 0.8-4). The issue arises from avahi-daemon-check-dns.sh being executed with root privileges via /etc/network/if-up.d/avahi-daemon, enabling a local attacker to cause denial of service or create arbitrary empty files through a symlink attack o...

CVE-2023-1981

CVE-2023-1981 affects the avahi library. An unprivileged user can cause the avahi-daemon to crash by issuing a DBus call, potentially impacting service discovery on affected systems. Public references describe the issue as a crash via DBus with a CVSS vector noting Local access, Low attack comple...

CVE-2021-3502

CVE-2021-3502 affects Avahi (vulnerable: avahi 0.8-5). The flaw is a reachable assertion in the function avahi_s_host_name_resolver_start , which allows a local attacker to crash the avahi-daemon by issuing hostname resolutions for badly formatted hostnames via the avahi socket or D-Bus. Impact: ...

CVE-2010-2244

CVE-2010-2244 is an Avahi DoS in avahi-daemon (avahi-core/socket.c, Avahi 0.6.16 and 0.6.25) triggered by processing a malformed DNS packet and a following valid checksum packet. Connected sources confirm this vulnerability and that multiple distros released fixes (e.g., Debian DSA-2086-1; CentOS...

CVE-2008-5081

CVE-2008-5081 affects Avahi; the avahi-daemon process in Avahi before version 0.6.24 is vulnerable to a remote denial of service. A crafted mDNS packet with a source port of 0 can trigger an assertion in originates_from_local_legacy_unicast_socket() and cause the daemon to crash or exit. Public s...

CVE-2025-59529

Avahi (up to version 0.9-rc2) is vulnerable because the simple protocol server ignores the documented CLIENTS_MAX limit: server_work() unconditionally accepts new connections and client_new() always appends a client, with no check against the limit. This allows unprivileged local users to exhaust...

CVE-2025-68471

CVE-2025-68471 affects Avahi (0.9-rc2 and earlier) and is triggered by processing two unsolicited announcements with CNAME records, leading to a crash/DoS via a reachable assertion in lookup_start. Connected advisories indicate fixes in avahi packages (e.g., openSUSE/SUSE advisories;Mariner notes...

CVE-2026-24401

CVE-2026-24401 affects Avahi (avahi-daemon) for versions 0.9rc2 and earlier. The issue is a segmentation fault caused by an unsolicited mDNS response containing a recursive CNAME where the alias and canonical name are the same (e.g., h.local -> h.local), triggering unbounded recursion in looku...

CVE-2007-3372

CVE-2007-3372 affects the Avahi daemon, with vulnerable releases prior to 0.6.20. An attacker can trigger a denial of service by sending empty TXT data over D-Bus, causing an assertion failure. A fix is available in Avahi 0.6.20 and later (updates referenced in the milestoned changeset). If apply...

CVE-2006-5461

Avahi

CVE-2006-6870

The CVE-2006-6870 vulnerability affects Avahi prior to 0.6.16, where the consume_labels function in avahi-core/dns.c can be triggered by a crafted compressed DNS response containing a label that points to itself. This leads to a denial of service via an infinite loop. Evidence across multiple adv...

CVE-2025-68468

Summary: CVE-2025-68468 affects the Avahi package. Affected component: avahi-daemon; issue: a reachable assertion in lookup_multicast_callback can cause the daemon to crash when processing certain unsolicited CNAME records or during wide-area/broadcast traffic, leading to denial of service. Affec...

CVE-2006-2289

CVE-2006-2289 is a buffer overflow vulnerability in Avahi’s avahi-core, affecting Avahi before 0.6.10. The issue allows local users to execute arbitrary code via unknown vectors due to a buffer overflow in avahi-core. Documented sources (SUSE, Ubuntu, Debian and others) describe the vulnerability...

CVE-2006-2288

Avahi in versions prior to 0.6.10 is affected by CVE-2006-2288, allowing local users to trigger a denial of service by causing mDNS/DNS-SD service disconnects due to unspecified mDNS name conflicts. The available documents identify the affected product and the general impact but do not provide ex...

CVE-2025-68276

CVE-2025-68276 affects Avahi (mDNS/DNS-SD service discovery). The issue allows an unprivileged local user to crash the avahi-daemon (with wide-area disabled) by creating record browsers that set the AVAHI_LOOKUP_USE_WIDE_AREA flag via D‑Bus, either through RecordBrowserNew or browsers that create...

CVE-2026-34933

CVE-2026-34933 affects Avahi prior to 0.9-rc4. An unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags, resulting in a Denial of Service. The issue is mitigated by upgrading to version 0.9-rc4 or later. The referenced sources confirm ...