CVE-2026-48487

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.

• CWE-130

• https://github.com/python-zeroconf/python-zeroconf/commit/544449596e645fcaad3834fa0cb614a54f847a82Patch
• https://github.com/python-zeroconf/python-zeroconf/issues/1752Issue Tracking, Patch
• https://github.com/python-zeroconf/python-zeroconf/pull/1756Issue Tracking, Patch
• https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.149.16Release Notes
• https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9Vendor Advisory

Published

Jul 17, 2026

Last Modified

Aug 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4848A vulnerability was determined in dameng100 muucmf 1.9.5.202…4.3
• CVE-2026-48480The netty incubator codec.bhttp is a java language binary ht…6.6
• CVE-2026-48482GLPI is a free asset and IT management software package. Fro…9.4
• CVE-2026-48483TypeBot is a chatbot builder tool. Prior to version 3.17.0, …5.4
• CVE-2026-48485Quest Bot is an opensource Discord Bot. Prior to version 1.1…2.1
• CVE-2026-48486Signum Node is a HDD-mined cryptocurrency using an energy ef…7.5
• CVE-2026-48488phpMyFAQ is an open source FAQ web application. Prior to ver…2.7
• CVE-2026-48489Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-4849A vulnerability was identified in code-projects Simple Laund…6.1
• CVE-2026-48490ArduinoCore-avr contains the source code and configuration f…6.9
• CVE-2026-48491Traefik is an HTTP reverse proxy and load balancer. From 3.7…10
• CVE-2026-48492Snipe-IT is an IT asset/license management system. Prior to …6.5