An update for python-zeroconf is now available for openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3294 Final 1.0 1.0 2026-08-07 Initial 2026-08-07 2026-08-07 openEuler SA Tool V1.0 2026-08-07 python-zeroconf security update An update for python-zeroconf is now available for openEuler-24.03-LTS-SP1 Pure Python Multicast DNS Service Discovery Library (Bonjour/Avahi compatible) Security Fix(es): Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5.(CVE-2026-47180) Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6.(CVE-2026-47183) Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, slower async_expire passes, and broken discovery, registration, and ServiceBrowser callbacks. This issue is fixed in version 0.149.7.(CVE-2026-47184) Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12.(CVE-2026-48045) An update for python-zeroconf is now available for openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS-SP1. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium python-zeroconf https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3294 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-47180 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-47183 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-47184 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-48045 https://nvd.nist.gov/vuln/detail/CVE-2026-47180 https://nvd.nist.gov/vuln/detail/CVE-2026-47183 https://nvd.nist.gov/vuln/detail/CVE-2026-47184 https://nvd.nist.gov/vuln/detail/CVE-2026-48045 openEuler-24.03-LTS-SP1 python-zeroconf-0.136.0-1.oe2403sp1.src.rpm python-zeroconf-help-0.136.0-1.oe2403sp1.noarch.rpm python3-zeroconf-0.136.0-1.oe2403sp1.noarch.rpm Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5. 2026-08-07 CVE-2026-47180 openEuler-24.03-LTS-SP1 Medium 6.5 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-zeroconf security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3294 Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6. 2026-08-07 CVE-2026-47183 openEuler-24.03-LTS-SP1 Medium 6.5 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-zeroconf security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3294 Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, slower async_expire passes, and broken discovery, registration, and ServiceBrowser callbacks. This issue is fixed in version 0.149.7. 2026-08-07 CVE-2026-47184 openEuler-24.03-LTS-SP1 Medium 6.5 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-zeroconf security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3294 Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12. 2026-08-07 CVE-2026-48045 openEuler-24.03-LTS-SP1 Medium 6.5 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-zeroconf security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3294