Threats affecting pkg:brew/homeassistant-cli

A vulnerability in the Airshare zeroconf component of homeassistant-cli allows unauthenticated attackers on the local network to cause memory exhaustion by sending malformed mDNS packets. This occurs due to unbounded storage of exception deduplication state that retains large packet buffers, potentially leading to out-of-memory conditions and service degradation. The issue is fixed in zeroconf version 0.149.6. No in-process workaround exists, so upgrading or restricting mDNS traffic to trusted network segments is recommended.

The Airshare zeroconf component in homeassistant-cli has an unbounded DNS record cache vulnerability (CVE-2026-47184) that allows any unauthenticated host on the local network to exhaust device memory by flooding multicast DNS responses. This leads to degraded performance or denial of service. The issue is fixed in zeroconf version 0.149.6. No in-process workaround exists, so network-level restrictions on multicast DNS traffic are recommended until upgrading.

A vulnerability in python-zeroconf prior to version 0.149.12 allows unauthenticated attackers on the local network to exhaust memory and CPU resources by sending spoofed truncated mDNS queries. This can cause denial of service conditions such as process crashes or degraded zeroconf functionality on affected devices. The issue is fixed in version 0.149.12.

A vulnerability in the Airshare zeroconf Python library used by homeassistant-cli allows unauthenticated local network hosts to inject malformed mDNS records with invalid length fields. This causes cache corruption by desynchronizing the parser state and inserting attacker-shaped records into the local mDNS cache. The issue affects versions prior to 0.149.16 and is fixed in that version. It does not enable remote code execution or denial of service but can poison the local mDNS cache, potentially impacting services relying on zeroconf discovery.

This update for python-zeroconf fixes the following issues: Changes in python-zeroconf: - CVE-2026-47180: zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service (bsc#1268341) - CVE-2026-47183: zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion (bsc#1268342) - CVE-2026-47184: zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood (bsc#1268343) - CVE-2026-48045: python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood (bsc#1268388) - CVE-2026-48487: python-zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet (bsc#1268235)