Avahi
Vulnerability activity for Avahi: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 6
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.5MediumApr 3, 2026avahiCVE-2026-34933Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.
- 6.5MediumJan 24, 2026avahi Denial of serviceCVE-2026-24401Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects rec
- 6.5MediumJan 12, 2026avahiCVE-2025-68471Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart.
- 6.5MediumJan 12, 2026avahiCVE-2025-68468Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes.
- 5.5MediumJan 12, 2026avahiCVE-2025-68276Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.
- 5.5MediumDec 18, 2025avahi Denial of serviceCVE-2025-59529Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc5, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted
- 5.3MediumNov 21, 2024AvahiCVE-2024-52616A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.
- 5.3MediumNov 21, 2024avahi Crypto / certificateCVE-2024-52615A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
- 6.2MediumNov 2, 2023avahiCVE-2023-38473A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.
- 6.2MediumNov 2, 2023avahiCVE-2023-38472A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
- 6.2MediumNov 2, 2023avahiCVE-2023-38471A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
- 6.2MediumNov 2, 2023avahiCVE-2023-38470A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
- 6.2MediumNov 2, 2023avahiCVE-2023-38469A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
Top products
- avahi6 CVEs in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.