SB2026071205 - Multiple vulnerabilities in Avahi

Description

This security bulletin contains information about 2 vulnerabilities.

1) Reachable assertion (CVE-ID: CVE-2026-59987)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to reachable assertion in dbus_prepare_record_browser_object when handling a D-Bus RecordBrowserNew method call with a crafted name that passes validation but cannot be normalized. A local user can send a specially crafted D-Bus method call to cause a denial of service.

2) Input validation error (CVE-ID: CVE-2026-58406)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in avahi_domain_hash when processing mDNS resource records with names containing bytes greater than or equal to 128. A remote attacker can send a specially crafted multicast DNS response packet to cause a denial of service.

The issue affects NetBSD systems on architectures where char is signed and invalid ctype(3) inputs trigger a SIGSEGV.

Remediation

Install update from vendor's website.

References

• https://github.com/avahi/avahi/security/advisories/GHSA-4v6h-9g73-wm5j
• https://github.com/avahi/avahi/pull/939
• https://github.com/avahi/avahi/security/advisories/GHSA-8pmv-23p5-92mw
• https://github.com/NetBSD/src/commit/f1ab872339bbbcd73177f26d512a7d0dcff11ba5