The python-zeroconf library's AsyncListener.handle_query_or_defer method retains every truncated (TC-bit) incoming mDNS query in an unbounded per-address queue and sets a timer to flush the reassembled query. Neither the queue length nor the number of distinct source addresses is limited. Each incoming query triggers an O(N) deduplication check over the queue, causing CPU usage to grow quadratically as the queue grows. An unauthenticated attacker on the local link can send a flood of spoofed truncated mDNS queries (up to 8966 bytes each) to exhaust memory and CPU resources, leading to denial of service. This is particularly impactful on memory-constrained devices such as Raspberry Pi running Home Assistant. The vulnerability is tracked as CVE-2026-48045 and fixed in python-zeroconf version 0.149.12.

An unauthenticated attacker on the local network can cause denial of service by exhausting memory and CPU resources on devices running vulnerable versions of python-zeroconf. This can result in process crashes (OOM kills) or degraded zeroconf service functionality, impacting discovery and registration features. The vulnerability does not affect confidentiality or integrity but causes availability disruption.

Upgrade python-zeroconf to version 0.149.12 or later, which contains the fix for this vulnerability. There is no in-process workaround. Alternatively, restrict mDNS traffic (UDP port 5353) to trusted Layer-2 network segments using access point client isolation, guest network separation, or host firewall rules to limit exposure to untrusted hosts.