{"id":"CVE-2026-48487","aliases":["GHSA-qc2x-6f54-m6h9","PYSEC-2026-3438"],"url":"https://o3.security/vulnerability/CVE-2026-48487","summary":"Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet","details":"Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.","published":"2026-07-17T18:28:21.417Z","modified":"2026-08-19T03:48:18.122929677Z","cvss":null,"epss":{"score":0.00248,"percentile":0.1597,"asOf":"2026-09-07"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"zeroconf","fixedVersion":"0.149.16"}],"fix":{"url":"https://github.com/python-zeroconf/python-zeroconf/commit/544449596e645fcaad3834fa0cb614a54f847a82","label":"python-zeroconf/python-zeroconf@5444495"},"references":[{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.16"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48487.json"},{"type":"ADVISORY","url":"https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48487"},{"type":"REPORT","url":"https://github.com/python-zeroconf/python-zeroconf/issues/1752"},{"type":"FIX","url":"https://github.com/python-zeroconf/python-zeroconf/commit/544449596e645fcaad3834fa0cb614a54f847a82"},{"type":"FIX","url":"https://github.com/python-zeroconf/python-zeroconf/pull/1756"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-19T03:48:18.122929677Z"}}