PyPI/zeroconf CVE-2026-48045: medium 6.5, EPSS 0.37%

python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

Action: Upgrade zeroconf to 0.149.12 or later.

pip install zeroconf==0.149.12

Affected

Fixed versions

Sources

• osv: PYSEC-2026-3435
• https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9663-mqmp-p9mm
• https://github.com/python-zeroconf/python-zeroconf/pull/1751
• https://github.com/python-zeroconf/python-zeroconf/commit/b22c8ff19c66c68907d220a4823c0950f4fa93f7
• https://github.com/python-zeroconf/python-zeroconf
• https://pypi.org/project/zeroconf
• https://github.com/advisories/GHSA-9663-mqmp-p9mm
• https://nvd.nist.gov/vuln/detail/CVE-2026-48045

CVE-2026-48045 · published 2026-07-13T15:46:16.573699Z · modified 2026-07-13T16:33:27.758889164Z · JSON