zeroconf has 5 CVEs on record. The busiest recent month was May 2026 with 3. The median CVSS is 6.5 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 0 prev 5
Worst active — by depth score
CVE-2026-48487Medium· 6.5zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet36CVE-2026-48045Medium· 6.5python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood36CVE-2026-47184Medium· 6.5zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood36CVE-2026-47183Medium· 6.5zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion36CVE-2026-47180Medium· 6.5zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service36
zeroconf vulnerabilities
CVEs affecting zeroconf, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-48487Medium· 6.5zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
CVE-2026-48045Medium· 6.5python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood
python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood
CVE-2026-47184Medium· 6.5zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
CVE-2026-47183Medium· 6.5zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion
zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion
CVE-2026-47180Medium· 6.5zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service
zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service