CVE-2025-59529 is a denial-of-service vulnerability in the avahi simple protocol server included in Red Hat Hardened Images. The flaw allows the server to ignore the documented client connection limit, accepting unlimited connections locally and enabling an attacker with local access to cause a denial of service. The issue affects multiple avahi RPM packages for aarch64 and x86_64 architectures. Red Hat has issued an advisory (RHSA-2026:7411) describing the update of these RPMs but currently does not provide a patch or mitigation that meets their criteria. The vulnerability has a CVSS v3 base score of 5.5 (medium severity) with an attack vector of local, low complexity, and no required user interaction.

The vulnerability allows an attacker with local access to cause a denial of service by overwhelming the avahi simple protocol server with unlimited client connections, ignoring the intended client limit. This impacts availability but does not affect confidentiality or integrity. There are no known exploits in the wild at this time.

Currently, no effective mitigation or patch is available that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for future updates. Customers with a Red Hat Technical Account Manager (TAM) can seek direct guidance. No immediate action is required beyond awareness and monitoring.