{"id":"CVE-2026-24401","title":"Avahi has Uncontrolled Recursion in lookup_handle_cname function","summary":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response conta…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-674"],"vendor":"avahi","product":"avahi","affected":["avahi < 0.9-rc3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-01-26T16:14:24.982686Z"},"published":"2026-01-24","updated":"2026-10-23","sourceUpdated":"2026-10-23T15:54:16.116Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-24401","references":[{"url":"https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3","label":"https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3"},{"url":"https://github.com/avahi/avahi/issues/501","label":"https://github.com/avahi/avahi/issues/501"},{"url":"https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524","label":"https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524"}],"tags":["cve.org"],"epss":0.00303,"epssPercentile":0.2192,"ingestedAt":"2026-10-23T16:31:11.325Z","slug":"CVE-2026-24401","body":"## Overview\n\nAvahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.\n\n## Affected\n\n- `avahi < 0.9-rc3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}