PyPI/zeroconf CVE-2026-47184: medium 6.5, EPSS 0.39%

zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood

Action: Upgrade zeroconf to 0.149.7 or later.

pip install zeroconf==0.149.7

Affected

Fixed versions

Sources

• osv: PYSEC-2026-3439
• https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-rfg2-pjw2-56x2
• https://github.com/python-zeroconf/python-zeroconf/issues/1715
• https://github.com/python-zeroconf/python-zeroconf/pull/1718
• https://github.com/python-zeroconf/python-zeroconf
• https://pypi.org/project/zeroconf
• https://github.com/advisories/GHSA-rfg2-pjw2-56x2
• https://nvd.nist.gov/vuln/detail/CVE-2026-47184

CVE-2026-47184 · published 2026-07-13T15:19:14.814605Z · modified 2026-07-13T16:31:54.094652220Z · JSON