avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE) not the upstream Avahi product.

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.

A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.

A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.

The sequential increment of DNS transaction IDs makes Avahi vulnerable to DNS spoofing, allowing attackers to inject malicious DNS records. This can compromise the integrity of DNS responses, redirecting users to potentially harmful domains. This vulnerability poses a greater risk as it directly undermines the integrity of DNS resolution, affecting all systems using Avahi for wide-area DNS queries unless mitigations are applied.

This vulnerability exposes Avahi-daemon to potential DNS spoofing attacks by using a fixed source port for queries. However, the impact is limited because it only affects wide-area DNS and can be mitigated by forwarding queries to local DNS resolvers (e.g., systemd-resolved), which provide better randomization. The impact is primarily on systems actively using wide-area DNS, with .local mDNS being unaffected.

A flaw was found in avahi 0.8-5. A reachable assertion is present in avahishostnameresolverstart function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.

A flaw was found in avahi deamon. Denial of service can be triggered by writing long lines to /run/avahi-daemon/socket resulting in an unresponsive busy-loop of the daemon.

References:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=984938

The originatesfromlocallegacyunicastsocket function in avahi-core/server.c in avahi-daemon 0.6.23 does not account for the network byte order of a port number when processing incoming multicast packets, which allows remote attackers to cause a denial of service (network bandwidth and CPU consumption) via a crafted legacy unicast mDNS query packet that triggers a multicast packet storm.

Avahi before 0.6.15 does not verify the sender identity of netlink messages to ensure that they come from the kernel instead of another process, which allows local users to spoof network changes to Avahi.

The consumelabels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) via a crafted compressed DNS response with a label that points to itself.

https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc advises: Reachable assertion in transportflagsfromdomain (CVE-2026-34933)

Moderate evverx published GHSA-w65r-6gxh-vhvc Apr 1, 2026

Affected versions: <=v0.9-rc3 Patched versions: v0.9-rc4

Description ----------- In all versions up to and including 0.8 and 0.9-rc3, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags.

The AVAHIPUBLISHUSEMULTICAST (0x100) and AVAHIPUBLISHUSEWIDEAREA (0x80) flags are individually accepted by the AVAHIFLAGSVALID() validation macro at entry.c:201-209 (for AddRecord) and entry.c:593-597 (for AddService), since both are listed in the allowed flags bitmask. However, these flags are mutually exclusive, and the function transportflagsfromdomain() at entry.c:57 enforces this exclusivity with an assert():

static void transportflagsfromdomain(AvahiServer s, AvahiPublishFlags flags, const char domain) { assert(flags); assert(domain);

assert(!((flags & AVAHIPUBLISHUSEMULTICAST) && (flags & AVAHIPUBLISHUSEWIDEAREA))); // ... }

When both flags are set simultaneously (flags = 0x180), the assertion fails, causing the daemon to abort with SIGABRT. The D-Bus system bus policy (avahi-dbus.conf) allows any local user to call EntryGroupNew and AddService without restrictions.

Root cause ---------- The flags validation (AVAHIFLAGSVALID) and the mutual exclusivity check (assert in transportflagsfromdomain) are performed at different layers with no coordination:

1. AVAHIFLAGSVALID(flags, mask) checks !(flags & ~mask) -- it verifies that no unknown bits are set, but does not check for mutually exclusive combinations. 2. transportflagsfromdomain() enforces mutual exclusivity via assert(), which is a fatal operation in a production daemon.

Affected D-Bus methods ---------------------- The following D-Bus methods on org.freedesktop.Avahi.EntryGroup accept a flags parameter that reaches the vulnerable function:

Method D-Bus handler Core function AddService dbus-entry-group.c:166 serveraddservicestrlstnocopy() -> transportflagsfromdomain() AddServiceSubtype dbus-entry-group.c:213 serveraddservicestrlstnocopy() -> transportflagsfromdomain() AddAddress dbus-entry-group.c:280 avahiserveraddaddress() -> transportflagsfromdomain() AddRecord dbus-entry-group.c:311 avahiserveradd() -> serveraddinternal() -> transportflagsfromdomain() UpdateServiceTxt dbus-entry-group.c:370 serverupdateservicetxtstrlstnocopy() -> transportflagsfromdomain()

Proof of Concept ----------------

#!/usr/bin/env python3 """Any local unprivileged user can crash avahi-daemon with this script.""" import dbus

AVAHIPUBLISHUSEWIDEAREA = 128 # 0x80 AVAHIPUBLISHUSEMULTICAST = 256 # 0x100 CONFLICTINGFLAGS = AVAHIPUBLISHUSEWIDEAREA | AVAHIPUBLISHUSEMULTICAST

bus = dbus.SystemBus() server = dbus.Interface( bus.getobject('org.freedesktop.Avahi', '/'), 'org.freedesktop.Avahi.Server' )

Create an entry group egpath = server.EntryGroupNew() eg = dbus.Interface( bus.getobject('org.freedesktop.Avahi', egpath), 'org.freedesktop.Avahi.EntryGroup' )

Trigger the crash: AddService with both MULTICAST and WIDEAREA flags eg.AddService( dbus.Int32(-1), # interface (AVAHIIFUNSPEC) dbus.Int32(-1), # protocol (AVAHIPROTOUNSPEC) dbus.UInt32(CONFLICTINGFLAGS), # flags = 0x180 (CRASH) dbus.String("PoC-Service"), # name dbus.String("http.tcp"), # type dbus.String(""), # domain dbus.String(""), # host dbus.UInt16(8080), # port dbus.Array([], signature='ay') # TXT records )

Reproduction ------------

On any Linux system with avahi-daemon running: apt install python3-dbus # if not already installed python3 poc.py

Verify crash: systemctl status avahi-daemon Expected: "avahi-daemon.service: Main process exited, code=exited, status=134/n/a"

journalctl -u avahi-daemon -n 5 Expected: "entry.c:57: transportflagsfromdomain: Assertion !((flags & AVAHIPUBLISHUSEMULTICAST) && (flags & AVAHIPUBLISHUSEWIDEAREA))' failed."

Impact ------

Any unprivileged local user can immediately crash the avahi-daemon process. All mDNS/DNS-SD services on the host become unavailable. Applications relying on nss-mdns for .local hostname resolution fail. Network service discovery (printers, Chromecast, AirPlay, etc.) stops. While systemd auto-restarts the daemon, repeated crashes cause a persistent DoS.

Credit ------ Discovered by Guillaume MEUNIER - Head of VOC France - Orange Cyberdefense on 2026-03-10.

Fix --- It was addressed in <https://github.com/avahi/avahi/pull/891>.

Severity: Moderate - 5.5 / 10 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-34933 Weakness: CWE-617 -- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookuphandlecname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHILOOKUPUSEMULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524.

Avahi has a reachable assertion in lookupstart

Avahi has a reachable assertion in lookupmulticastcallback

Avahi has a reachable assertion in avahiwideareascancache

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although CLIENTSMAX is defined, serverwork() unconditionally accept()s and clientnew() always appends the new client and increments nclients. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve .local. names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket /run/avahi-daemon/socket, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users.

https://github.com/avahi/avahi/security/advisories/GHSA-73wf-3xmj-x82q advises: Summary -------

The simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS.

Details -------

Although CLIENTSMAX is defined, serverwork() unconditionally accept()s and clientnew() always appends the new client and increments nclients. There is no check against the limit.

When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection.

PoC ---

Flood the UNIX simple-protocol socket with idle connections for i in $(seq 1 4000); do socat - UNIX-CONNECT:/run/avahi-daemon/socket >/dev/null 2>&1 & done wait

Watch avahi-daemon’s memory/FD count grow until it becomes unresponsive or crashes, such as an endless loop of:

accept(): Too many open files accept(): Too many open files accept(): Too many open files accept(): Too many open files accept(): Too many open files accept(): Too many open files accept(): Too many open files accept(): Too many open files accept(): Too many open files accept(): Too many open files accept(): Too many open files accept(): Too many open files accept(): Too many open files accept(): Too many open files

Impact ------

Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD.

Exahusting local file descriptors causes increased system load caused by logging errors of each of request.

Overloading prevents glibc calls using nss-mdns plugins to resolve .local. names and link-local addresses.

Workarounds -----------

Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket /run/avahi-daemon/socket, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface.

It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users.

Fixes -----

Candidate only: https://github.com/avahi/avahi/pull/808

Credits -------

We would like to thank Joshua Rogers using the ZeroPath tool for discovering and reporting the issue responsibly.

published article about it: Avahi Simple Protocol Server DoS (CVE-2025-59529) https://zeropath.com/blog/avahi-simple-protocol-server-dos-cve-2025-59529

Severity: Moderate, 5.5 / 10 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2025-59529 Weaknesses: CWE-400 -- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive information from the responding device via port-5353 UDP packets. NOTE: this may overlap CVE-2015-2809.

A reachable assertion was found in avahidnspacketappendrecord.

References:

https://github.com/lathiat/avahi/issues/455

A reachable assertion was found in avahiescapelabel.

References:

https://github.com/lathiat/avahi/issues/454

A reachable assertion was found in avahialternativehostname.

References:

https://github.com/lathiat/avahi/issues/451

A reachable assertion was found in avahirdataparse.

References:

https://github.com/lathiat/avahi/issues/452

A reachable assertion was found in dbussethostname.

References:

https://github.com/lathiat/avahi/issues/453

A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash.

Moderate: avahi security update

It was found that avahi responds to unicast queries coming from outside of local network which may cause an information leak, such as disclosing the device type/model that responds to the request or the operating system. The mDNS response may also be used to amplify denial of service attacks against other networks as the response size is greater than the size of request.

External References:

https://www.kb.cert.org/vuls/id/550620

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-1002. Reason: This candidate is a reservation duplicate of CVE-2011-1002. Notes: All CVE users should reference CVE-2011-1002 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

Avahi before 0.6.10 allows local users to cause a denial of service (mDNS/DNS-SD service disconnect) via unspecified mDNS name conflicts.

Buffer overflow in avahi-core in Avahi before 0.6.10 allows local users to execute arbitrary code via unknown vectors.