{"id":"CVE-2026-48045","aliases":["GHSA-9663-mqmp-p9mm","PYSEC-2026-3435"],"url":"https://o3.security/vulnerability/CVE-2026-48045","summary":"Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood","details":"Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12.","published":"2026-07-17T18:26:19.274Z","modified":"2026-08-19T03:48:17.623124544Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.0037,"percentile":0.29698,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"zeroconf","fixedVersion":"0.149.12"}],"fix":{"url":"https://github.com/python-zeroconf/python-zeroconf/commit/b22c8ff19c66c68907d220a4823c0950f4fa93f7","label":"python-zeroconf/python-zeroconf@b22c8ff"},"references":[{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.12"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48045.json"},{"type":"ADVISORY","url":"https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9663-mqmp-p9mm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48045"},{"type":"FIX","url":"https://github.com/python-zeroconf/python-zeroconf/commit/b22c8ff19c66c68907d220a4823c0950f4fa93f7"},{"type":"FIX","url":"https://github.com/python-zeroconf/python-zeroconf/pull/1751"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-19T03:48:17.623124544Z"}}