Segmentation Fault in Avahi Daemon due to CNAME Record Misconfiguration

CVE-2026-24401

What is CVE-2026-24401?

The Avahi daemon, a crucial component for local network service discovery using the mDNS/DNS-SD protocol suite, is susceptible to a segmentation fault triggered by an unsolicited mDNS response. Specifically, when a recursive CNAME record is sent, where both the alias and canonical name refer to the same domain (e.g., 'h.local'), it results in unbounded recursion within the lookup_handle_cname function, causing stack exhaustion. This vulnerability predominantly impacts record browsers where the AVAHI_LOOKUP_USE_MULTICAST option is explicitly set, including those developed by resolvers employed in nss-mdns. A fix has been implemented in a recent commit.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References