PyPI/zeroconf CVE-2026-47184: medium 6.5, EPSS 0.39%

zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood

Action: Upgrade zeroconf to 0.149.7 or later.

pip install zeroconf==0.149.7

Affected

Fixed versions

Sources

• osv: GHSA-rfg2-pjw2-56x2
• https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-rfg2-pjw2-56x2
• https://github.com/python-zeroconf/python-zeroconf/issues/1715
• https://github.com/python-zeroconf/python-zeroconf/pull/1718
• https://github.com/python-zeroconf/python-zeroconf

CVE-2026-47184 · published 2026-05-29T20:18:53Z · modified 2026-07-13T16:43:03.274039851Z · JSON