Log in Start free

Vulnerability · Published Jan 24, 2026 · Assigned by GitHub_M

CVE-2026-24401Avahi has Uncontrolled Recursion in lookup_handle_cname function

Medium 6.5

In plain English

A medium-severity security flaw in avahi from avahi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 68.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24avahi0.8-r25ALPINE-CVE-2026-24401
Debian:12avahino fix listedDEBIAN-CVE-2026-24401
Debian:13avahino fix listedDEBIAN-CVE-2026-24401
Debian:14avahi0.8-18DEBIAN-CVE-2026-24401
Ubuntu:22.04:LTSavahi0.8-5ubuntu5.5UBUNTU-CVE-2026-24401
Ubuntu:24.04:LTSavahi0.8-13ubuntu6.2UBUNTU-CVE-2026-24401
Ubuntu:25.10avahi0.8-16ubuntu3.2UBUNTU-CVE-2026-24401

Affected products (as reported)

VendorProductVersions
avahi avahi < 0.9-rc3

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References