avahi has 7 CVEs on record between 2023 and 2026. The median CVSS is 6.2 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-617 (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.2
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
CVE-2025-59529Medium· 5.5Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite42CVE-2026-24401Medium· 6.5Avahi has Uncontrolled Recursion in lookup_handle_cname function36CVE-2023-38473Medium· 6.2Reachable assertion in avahi_alternative_host_name34CVE-2023-38472Medium· 6.2Reachable assertion in avahi_rdata_parse34CVE-2023-38471Medium· 6.2Reachable assertion in dbus_set_host_name34
avahi vulnerabilities
CVEs affecting avahi, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-24401Medium· 6.5Avahi has Uncontrolled Recursion in lookup_handle_cname function
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response conta…
CVE-2025-59529Medium· 5.5PoCAvahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited co…
CVE-2023-38469Medium· 6.2Reachable assertion in avahi_dns_packet_append_record
A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
CVE-2023-38470Medium· 6.2Reachable assertion in avahi_escape_label
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
CVE-2023-38471Medium· 6.2Reachable assertion in dbus_set_host_name
A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
CVE-2023-38472Medium· 6.2Reachable assertion in avahi_rdata_parse
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
CVE-2023-38473Medium· 6.2Reachable assertion in avahi_alternative_host_name
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.