Search: CVE-2026-24401

Avahi versions 0.9-rc2 and earlier contain a vulnerability where an unsolicited mDNS response with a recursive CNAME record pointing to the same domain causes unbounded recursion. This leads to a stack exhaustion and crashes the avahi-daemon process. The issue affects record browsers using AVAHI_LOOKUP_USE_MULTICAST, including those used by nss-mdns. The vulnerability is fixed in version 0.9-rc3.