Fix numerous CVEs in Avahi

[Douglas R. Reno]

While reviewing my email this morning, I noticed that I got another email from oss-security regarding a security vulnerability in Avahi.

At that point I decided to take a look at ​https://github.com/avahi/avahi/security and see what we are missing. Currently we only have a fix for CVE-2021-3468. There is one vulnerability there on the second page which is unpatched and has no CVE but it's impact is extremely minor so I don't think it's worth waiting on at the moment.

These vulnerabilities have been fixed in a release candidate version of Avahi, but it's probably best to stay with the released version from 2020 for now. There is an additional CVE which still has a PR going through review that could allow for all system file descriptors to be drained via an extremely easy local DoS, but it is having both CI problems and issues with breaking Avahi on other platforms. For anyone interested, that is ​https://github.com/avahi/avahi/security/advisories/GHSA-73wf-3xmj-x82q

We will need to fix the following vulnerabilities:

• ​https://github.com/avahi/avahi/security/advisories/GHSA-v99h-rhv2-7mpq ... CVE-2024-2699 and also CVE-2026-24401. Uncontrolled recursion in lookup_handle_cname. This is a denial of service impact (segfault), but is fixed by ​https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524. Rated as Medium

• ​https://github.com/avahi/avahi/security/advisories/GHSA-56rf-42xr-qmmg ... CVE-2025-68471. Reachable assertion in lookup_start. This is another denial of service impact (application crash), but is fixed by ​https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1. Rated as Medium

• ​https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g ... CVE-2024-52615. Avahi Wide-Area DNS Uses Constant Source Port. As mentioned in the advisory, in some configurations this can open up the door to DNS spoofing. Fixed by ​https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942. Rated as Medium.

• ​https://github.com/avahi/avahi/security/advisories/GHSA-r9j3-vjjh-p8vm ... CVE-2024-52616. Avahi Wide-Area DNS Predictable Transaction IDs. As mentioned in the advisory, it allows for attackers to inject DNS records in some configurations. Fixed by ​https://github.com/avahi/avahi/pull/659.patch

• ​https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52 ... CVE-2025-68468. Reachable assertion in lookup_multicast_callback. This causes Avahi to crash. Fixed by ​https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a

• ​https://github.com/avahi/avahi/security/advisories/GHSA-mhf3-865v-g5rc ... CVE-2025-68276. Reachable assertion in avahi_wide_area_scan_cache. This looks to be another crash caused by calling functions related to wide area support when wide area support is disabled. Fixed by ​https://patch-diff.githubusercontent.com/raw/avahi/avahi/pull/806.patch

• ​https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc ... CVE-2026-34933. Reachable assertion in transport_flags_from_domain. Any unprivileged user can crash Avahi this way by simply sending a D-Bus call with conflicting publish flags. Fixed by ​https://patch-diff.githubusercontent.com/raw/avahi/avahi/pull/891.patch

Note that the above issue was discovered and resolved by the head of the Vulnerability Operations Center for a cybersecurity company in France.

• ​https://github.com/advisories/GHSA-5qm6-j92f-79jp ... CVE-2023-38473. Reachable assertion in avahi_alternative_host_name. Fixed by ​https://github.com/avahi/avahi/pull/486 and rated as Medium.

• ​https://github.com/advisories/GHSA-4g3h-v9fp-pgm4 ... CVE-2023-38472. Reachable assertion in the avahi_rdata_parse() function. Fixed by ​https://github.com/avahi/avahi/pull/490 and rated as Medium.

• ​https://github.com/advisories/GHSA-h3x3-j454-4phv ... CVE-2023-38471. Reachable assertion in the dbus_set_host_name function. Fixed by ​https://github.com/avahi/avahi/pull/494 and ​https://github.com/avahi/avahi/pull/499 and rated as Medium.

• ​https://github.com/advisories/GHSA-mg8v-g9mc-p4f8 ... CVE-2023-38470. Reachable assertion in avahi_escape_label. Fixed by ​https://github.com/avahi/avahi/pull/457 and rated as Medium.

• ​https://github.com/advisories/GHSA-cg96-q9gq-2pr7 ... CVE-2023-38469. Reachable assertion in avahi_dns_packet_append_record. Fixed by ​https://github.com/avahi/avahi/pull/500 and rated as Medium.

• ​https://github.com/advisories/GHSA-55h6-xcvg-4r99 ... CVE-2023-1981. avahi-daemon can be crashed via DBus. Fixed by ​https://github.com/avahi/avahi/pull/407 and rated as Medium.

• ​https://github.com/advisories/GHSA-mw7q-3wxj-rqfx ... CVE-2021-3502 and CVE-2021-36217. Reachable assertion in avahi_s_host_name_resolver_start when resolving bad hostnames causes the server to crash. Fixed by ​https://github.com/avahi/avahi/pull/324 and rated as Medium.

As usual with Avahi, things are quite a mess upstream. They have been trying to get a new release out (0.9) and it is now well over a year overdue. ​https://github.com/avahi/avahi/issues/503

If you check the issue linked above, please ignore CVE-2021-26720. It is specific to how Debian is packaging it.

We should resolve these however so we're on the same page as other distributions and because this package has been unmaintained for so long. The denial of service issues above can be exploited pretty easily by users for the most part, and there are also DNS spoofing issues for some configurations.

[Bruce Dubbs]

We could do like arch and use v0.9-rc4 (April 1st)

​https://github.com/avahi/avahi/tags

[Douglas R. Reno]

I'm going to reassign these to the book for now so whoever wants to do them can do them.

In the meantime I will continue working on rivendell, but I do not want to continue holding the project back on important issues.

[Bruce Dubbs]

I've installed the -rc5 version of this package and will mark this fixed. If there are any new security issues that need to be patched, then a new ticket should be created.

Fixed at commit df8a82caf0.