SB2026040975 - Multiple vulnerabilities in Avahi

Description

This security bulletin contains information about 2 vulnerabilities.

1) Reachable assertion (CVE-ID: CVE-2026-34933)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to reachable assertion in transport_flags_from_domain() when handling D-Bus method calls with conflicting publish flags. A local user can send a specially crafted D-Bus method call to cause a denial of service.

The issue can be triggered through org.freedesktop.Avahi.EntryGroup methods that accept a flags parameter, and repeated crashes can result in persistent service disruption if the daemon is automatically restarted.

2) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to reachable assertion in service_browser_callback when processing unsolicited PTR resource records. A remote attacker can send specially crafted multicast DNS announcements to cause a denial of service.

The issue causes avahi-discover-standalone to abort due to an assertion failure.

Remediation

Install update from vendor's website.

References

• https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc
• https://github.com/advisories/GHSA-w65r-6gxh-vhvc
• https://github.com/avahi/avahi/security/advisories/GHSA-4475-5jrv-wv6j