Zeroconf up to 0.149.15 DNS Service Discovery incoming.py _read_character_string/_read_string RDLENGTH information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, was found in Zeroconf up to 0.149.15. Affected is the function _read_character_string/_read_string of the file src/zeroconf/_protocol/incoming.py of the component DNS Service Discovery. Executing a manipulation of the argument RDLENGTH can lead to information disclosure. This vulnerability is handled as CVE-2026-48487. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Zeroconf up to 0.149.15. It has been declared as problematic. This vulnerability affects the function _read_character_string/_read_string of the file src/zeroconf/_protocol/incoming.py of the component DNS Service Discovery. The manipulation of the argument RDLENGTH with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.

The advisory is available at github.com. This vulnerability was named CVE-2026-48487 since 05/21/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

Upgrading to version 0.149.16 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Zeroconf

Version

• 0.149.0
• 0.149.1
• 0.149.2
• 0.149.3
• 0.149.4
• 0.149.5
• 0.149.6
• 0.149.7
• 0.149.8
• 0.149.9
• 0.149.10
• 0.149.11
• 0.149.12
• 0.149.13
• 0.149.14
• 0.149.15

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion