USN-8269-1: Avahi vulnerabilities
It is discovered that Avahi incorrectly handled crafted input. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-24401) Guillaume Meunier discovered that Avahi incorrectly handled crafted input. An attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2026-34933)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/avahi-daemonto a version that resolves this vulnerability.Fixed in 0.8-18ubuntu1.1 - Upgrade
Upgrade
ubuntu/avahi-daemonto a version that resolves this vulnerability.Fixed in 0.8-16ubuntu3.2 - Upgrade
Upgrade
ubuntu/avahi-daemonto a version that resolves this vulnerability.Fixed in 0.8-13ubuntu6.2 - Upgrade
Upgrade
ubuntu/avahi-daemonto a version that resolves this vulnerability.Fixed in 0.8-5ubuntu5.5 - Upgrade
Upgrade
ubuntu/avahi-daemonto a version that resolves this vulnerability.Fixed in Ubuntu Pro
Event History
Frequently Asked Questions
Which Ubuntu releases are affected?
The advisory states that the issues affect Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
What could an attacker achieve?
A remote attacker may be able to send crafted input that crashes Avahi, causing a denial of service.
Are both CVEs associated with the same impact?
Yes. CVE-2026-24401 and CVE-2026-34933 are both described as crafted-input handling issues that could allow an attacker to crash the program and cause denial of service.