The Airshare zeroconf implementation's exception deduplication mechanism stores an unbounded dictionary keyed by exception messages derived from malformed mDNS packets. Each unique malformed packet causes a new entry retaining the full traceback, including frame locals that hold the raw inbound packet data (up to ~9 KB). This allows any unauthenticated host on the local network to cause continuous memory growth by sending crafted UDP/5353 packets, potentially exhausting memory and crashing the process. The vulnerability affects versions >=0.1.5 and <0.1.6_23 and is fixed in zeroconf 0.149.6.

An unauthenticated attacker on the local network can cause memory exhaustion in the Airshare zeroconf service by sending malformed mDNS packets, leading to process crashes and disruption of mDNS-dependent features such as HomeKit, Chromecast/Matter, AirPlay, and printers. This is particularly impactful on memory-constrained devices like Raspberry Pi running Home Assistant. There is no confidentiality or integrity impact reported.

Upgrade to zeroconf version 0.149.6 or later, which contains the official fix. There is no in-process workaround. Alternatively, restrict mDNS (UDP port 5353) traffic to trusted Layer-2 network segments using access point client isolation, guest network separation, or host firewall rules to prevent untrusted hosts from sending malicious packets.