---
id: CVE-2025-59529
title: >-
  Avahi is a system which facilitates service discovery on a local network via
  the mDNS/DNS-SD protocol suite
summary: >-
  Avahi is a system which facilitates service discovery on a local network via
  the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the
  simple protocol server ignores the documented client limit and accepts
  unlimited co…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: avahi
product: avahi
affected:
  - avahi < 0.9
  - avahi = 0.9
patched:
  - avahi 0.9
published: '2025-12-18'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59529'
references:
  - url: 'https://github.com/avahi/avahi/pull/808'
    label: security-advisories@github.com
  - url: 'https://github.com/avahi/avahi/security/advisories/GHSA-73wf-3xmj-x82q'
    label: security-advisories@github.com
  - url: 'https://zeropath.com/blog/avahi-simple-protocol-server-dos-cve-2025-59529'
    label: security-advisories@github.com
  - url: 'http://www.openwall.com/lists/oss-security/2025/12/19/1'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00179
epssPercentile: 0.06854
ingestedAt: '2026-10-13T11:23:51.140Z'
---

## Overview

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users.

## Affected

- `avahi < 0.9`
- `avahi = 0.9`

## Remediation

Upgrade past the affected range:

- `avahi 0.9`