Memory Exhaustion Vulnerability in Zeroconf by Python
CVE-2026-47183

6.5MEDIUM

Key Information:

Vendor

Python-zeroconf

Status
Python-zeroconf
Vendor
CVE Published:
17 July 2026

What is CVE-2026-47183?

The Zeroconf library prior to version 0.149.6 contains a memory exhaustion vulnerability due to unbounded logging of exception messages. This flaw allows local unauthenticated attackers to exploit IncomingDecodeError messages, leading to considerable memory growth. As the _seen_logs dictionary retains traces of raw packet data, systems may suffer performance degradation or experience out-of-memory conditions, especially in mDNS-dependent features. The vulnerability has been resolved in version 0.149.6.

Affected Version(s)

python-zeroconf < 0.149.6

References

https://github.com/python-zeroconf/python-zeroconf/securi...
x_refsource_CONFIRM
https://github.com/python-zeroconf/python-zeroconf/issues...
x_refsource_MISC
https://github.com/python-zeroconf/python-zeroconf/pull/1717
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.