id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
23150	Fix numerous CVEs in Avahi	Douglas R. Reno	Douglas R. Reno	"While reviewing my email this morning, I noticed that I got another email from oss-security regarding a security vulnerability in Avahi.

At that point I decided to take a look at https://github.com/avahi/avahi/security and see what we are missing. Currently we only have a fix for CVE-2021-3468. There is one vulnerability there on the second page which is unpatched and has no CVE but it's impact is extremely minor so I don't think it's worth waiting on at the moment.

These vulnerabilities have been fixed in a release candidate version of Avahi, but it's probably best to stay with the released version from 2020 for now. There is an additional CVE which still has a PR going through review that could allow for all system file descriptors to be drained via an extremely easy local DoS, but it is having both CI problems and issues with breaking Avahi on other platforms. For anyone interested, that is https://github.com/avahi/avahi/security/advisories/GHSA-73wf-3xmj-x82q

We will need to fix the following vulnerabilities:

- https://github.com/avahi/avahi/security/advisories/GHSA-v99h-rhv2-7mpq ... CVE-2024-2699 and also CVE-2026-24401. Uncontrolled recursion in lookup_handle_cname. This is a denial of service impact (segfault), but is fixed by https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524. Rated as Medium

- https://github.com/avahi/avahi/security/advisories/GHSA-56rf-42xr-qmmg ... CVE-2025-68471. Reachable assertion in lookup_start. This is another denial of service impact (application crash), but is fixed by https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1. Rated as Medium

- https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g ... CVE-2024-52615. Avahi Wide-Area DNS Uses Constant Source Port. As mentioned in the advisory, in some configurations this can open up the door to DNS spoofing. Fixed by https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942. Rated as Medium.

- https://github.com/avahi/avahi/security/advisories/GHSA-r9j3-vjjh-p8vm ... CVE-2024-52616.  Avahi Wide-Area DNS Predictable Transaction IDs. As mentioned in the advisory, it allows for attackers to inject DNS records in some configurations. Fixed by https://github.com/avahi/avahi/pull/659.patch

- https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52 ... CVE-2025-68468.  Reachable assertion in lookup_multicast_callback. This causes Avahi to crash. Fixed by https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a

- https://github.com/avahi/avahi/security/advisories/GHSA-mhf3-865v-g5rc ... CVE-2025-68276. Reachable assertion in avahi_wide_area_scan_cache. This looks to be another crash caused by calling functions related to wide area support when wide area support is disabled. Fixed by https://patch-diff.githubusercontent.com/raw/avahi/avahi/pull/806.patch

- https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc ... CVE-2026-34933. Reachable assertion in transport_flags_from_domain. Any unprivileged user can crash Avahi this way by simply sending a D-Bus call with conflicting publish flags. Fixed by https://patch-diff.githubusercontent.com/raw/avahi/avahi/pull/891.patch

Note that the above issue was discovered and resolved by the head of the Vulnerability Operations Center for a cybersecurity company in France.

- https://github.com/advisories/GHSA-5qm6-j92f-79jp ... CVE-2023-38473. Reachable assertion in avahi_alternative_host_name. Fixed by https://github.com/avahi/avahi/pull/486 and rated as Medium.

- https://github.com/advisories/GHSA-4g3h-v9fp-pgm4 ... CVE-2023-38472. Reachable assertion in the avahi_rdata_parse() function. Fixed by https://github.com/avahi/avahi/pull/490 and rated as Medium.

- https://github.com/advisories/GHSA-h3x3-j454-4phv ... CVE-2023-38471. Reachable assertion in the dbus_set_host_name function. Fixed by https://github.com/avahi/avahi/pull/494 and https://github.com/avahi/avahi/pull/499 and rated as Medium.

- https://github.com/advisories/GHSA-mg8v-g9mc-p4f8 ... CVE-2023-38470. Reachable assertion in avahi_escape_label. Fixed by https://github.com/avahi/avahi/pull/457 and rated as Medium.

- https://github.com/advisories/GHSA-cg96-q9gq-2pr7 ... CVE-2023-38469. Reachable assertion in avahi_dns_packet_append_record. Fixed by https://github.com/avahi/avahi/pull/500 and rated as Medium.

- https://github.com/advisories/GHSA-55h6-xcvg-4r99 ... CVE-2023-1981. avahi-daemon can be crashed via DBus. Fixed by https://github.com/avahi/avahi/pull/407 and rated as Medium.

- https://github.com/advisories/GHSA-mw7q-3wxj-rqfx ... CVE-2021-3502 and CVE-2021-36217. Reachable assertion in avahi_s_host_name_resolver_start when resolving bad hostnames causes the server to crash. Fixed by https://github.com/avahi/avahi/pull/324 and rated as Medium.

As usual with Avahi, things are quite a mess upstream. They have been trying to get a new release out (0.9) and it is now well over a year overdue. https://github.com/avahi/avahi/issues/503

If you check the issue linked above, please ignore CVE-2021-26720. It is specific to how Debian is packaging it.

We should resolve these however so we're on the same page as other distributions and because this package has been unmaintained for so long. The denial of service issues above can be exploited pretty easily by users for the most part, and there are also DNS spoofing issues for some configurations."	enhancement	closed	elevated	13.1	BOOK	git	medium	fixed