Allocation of Resources Without Limits or Throttling in Avahi - CVE-2025-59529

Vulnerability identifier: #VU120227

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-59529

CWE-ID: CWE-770

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to the application ignores the documented client limit and accepts unlimited connections. A local user can initiate multiple socket connections, exhaust daemon memory and file descriptors and perform a denial of service attack.

Avahi
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Basesystem Module
Desktop Applications Module
SUSE Package Hub 15
openSUSE Leap
Anolis OS
libavahi-core7-debuginfo
libavahi-common3-debuginfo
avahi-debuginfo-32bit
libavahi-common3-debuginfo-32bit
libavahi-client3-debuginfo-32bit
libdns_sd-debuginfo
libdns_sd
libavahi-client3
avahi-utils-debuginfo
avahi-debuginfo
libavahi-common3-32bit
avahi-debugsource
avahi-compat-mDNSResponder-devel
avahi-utils
avahi
libavahi-client3-32bit
libavahi-core7
libdns_sd-32bit
avahi-compat-howl-devel
libdns_sd-debuginfo-32bit
libavahi-common3
libavahi-devel
libavahi-client3-debuginfo
avahi-lang
avahi-autoipd
avahi-ui-tools
python3-avahi
avahi-compat-howl
avahi-compat-libdns_sd
avahi-compat-libdns_sd-devel
avahi-devel
avahi-dnsconfd
avahi-glib
avahi-glib-devel
avahi-gobject-devel
avahi-libs
avahi-qt5
avahi-qt5-devel
avahi-tools
avahi-ui-devel
avahi-ui-gtk3
avahi-gobject
libavahi-common3-32bit-debuginfo
libavahi-client3-32bit-debuginfo
avahi-glib2-debugsource
libavahi-gobject-devel
avahi-utils-gtk
libavahi-gobject0
libavahi-libevent1-debuginfo
typelib-1_0-Avahi-0_6
libavahi-glib1-32bit-debuginfo
libdns_sd-32bit-debuginfo
libavahi-glib1-32bit
avahi-32bit-debuginfo
libavahi-client3-64bit
libdns_sd-64bit
libavahi-client3-64bit-debuginfo
libdns_sd-64bit-debuginfo
libavahi-glib1-64bit-debuginfo
avahi-64bit-debuginfo
libavahi-common3-64bit-debuginfo
libavahi-common3-64bit
libavahi-glib1-64bit
libavahi-qt5-devel
avahi-autoipd-debuginfo
libhowl0-debuginfo
avahi-utils-gtk-debuginfo
libavahi-gobject0-debuginfo
libavahi-qt5-1
python3-avahi-gtk
libavahi-qt5-1-debuginfo
libavahi-glib-devel
libavahi-glib1
libhowl0
libavahi-ui-gtk3-0
libavahi-libevent1
libavahi-glib1-debuginfo
avahi-qt5-debugsource
libavahi-ui-gtk3-0-debuginfo

Install update from vendor's website.

Avahi - update to 0.9 rc3
libavahi-core7-debuginfo - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-common3-debuginfo - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-debuginfo-32bit - update to 0.6.32-32.45.1
libavahi-common3-debuginfo-32bit - update to 0.6.32-32.45.1
libavahi-client3-debuginfo-32bit - update to 0.6.32-32.45.1
libdns_sd-debuginfo - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
libdns_sd - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-client3 - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-utils-debuginfo - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-debuginfo - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-common3-32bit - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-debugsource - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-compat-mDNSResponder-devel - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-utils - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-client3-32bit - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-core7 - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
libdns_sd-32bit - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-compat-howl-devel - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
libdns_sd-debuginfo-32bit - update to 0.6.32-32.45.1
libavahi-common3 - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-devel - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-client3-debuginfo - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-lang - addressed in versions 0.6.32-32.45.1, 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-autoipd - update to 0.8-12
avahi - update to 0.8-12
avahi-ui-tools - update to 0.8-12
python3-avahi - update to 0.8-12
avahi-compat-howl - update to 0.8-12
avahi-compat-howl-devel - update to 0.8-12
avahi-compat-libdns_sd - update to 0.8-12
avahi-compat-libdns_sd-devel - update to 0.8-12
avahi-devel - update to 0.8-12
avahi-dnsconfd - update to 0.8-12
avahi-glib - update to 0.8-12
avahi-glib-devel - update to 0.8-12
avahi-gobject-devel - update to 0.8-12
avahi-libs - update to 0.8-12
avahi-qt5 - update to 0.8-12
avahi-qt5-devel - update to 0.8-12
avahi-tools - update to 0.8-12
avahi-ui-devel - update to 0.8-12
avahi-ui-gtk3 - update to 0.8-12
avahi-gobject - update to 0.8-12
libavahi-common3-32bit-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-client3-32bit-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-glib2-debugsource - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-gobject-devel - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-utils-gtk - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-gobject0 - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-libevent1-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
typelib-1_0-Avahi-0_6 - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-glib1-32bit-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libdns_sd-32bit-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-glib1-32bit - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-32bit-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-client3-64bit - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libdns_sd-64bit - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-client3-64bit-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libdns_sd-64bit-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-glib1-64bit-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-64bit-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-common3-64bit-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-common3-64bit - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-glib1-64bit - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-qt5-devel - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-autoipd-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
python3-avahi - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libhowl0-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-utils-gtk-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-gobject0-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-qt5-1 - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-autoipd - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
python3-avahi-gtk - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-qt5-1-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-glib-devel - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-glib1 - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libhowl0 - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-ui-gtk3-0 - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-libevent1 - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-glib1-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
avahi-qt5-debugsource - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1
libavahi-ui-gtk3-0-debuginfo - addressed in versions 0.8-150400.7.34.1, 0.8-150600.15.21.1

• https://github.com/avahi/avahi/security/advisories/GHSA-73wf-3xmj-x82q

• Local denial of service in Avahi
• Anolis OS update for avahi
• SUSE update for avahi
• SUSE update for avahi
• SUSE update for avahi