CVE-2026-24401
Avahi has Uncontrolled Recursion in lookup_handle_cname function
Reported by github_m · Published January 24, 2026
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which is part of version 0.9-rc3.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| avahi | Chainguard | 0.9_rc3-r0 |
| avahi | Alpine | 0.8-r25 |
| avahi | Wolfi | 0.9_rc3-r0 |
| avahi | avahi | 0.9 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| avahi | avahi | < 0.9-rc3 |
| chainguard | avahi | *, 0 |
| alpine | avahi | 0 |
| wolfi | avahi | 0, * |
| avahi | avahi | 0 |
Timeline
- Jan 24, 2026 EPSS Score (30 in total, the first dated here)
- Jan 24, 2026 CVE Published
- Jan 24, 2026 PoC Published
- Jan 29, 2026 Security Advisory (3 in total, the first dated here)
- Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
- Aug 11, 2026 Distribution Patch (2 in total, the first dated here)
- Sep 16, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-24401
vulnetix vdb fixes CVE-2026-24401Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-24401/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3 x_refsource_CONFIRM
- https://github.com/avahi/avahi/issues/501 x_refsource_MISC
- https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524 x_refsource_MISC