CVE-2026-24401: 
Avahi vulnerability analysis and mitigation

CVE-2026-24401 is an uncontrolled recursion vulnerability in Avahi, a system that facilitates service discovery on local networks via the mDNS/DNS-SD protocol suite. In versions 0.9-rc2 and below (all versions prior to 0.9-rc3), avahi-daemon can be crashed by receiving an unsolicited mDNS response containing a self-referential CNAME record (e.g., "h.local" as a CNAME for "h.local"), triggering unbounded recursion in the lookup_handle_cname function and causing stack exhaustion. The vulnerability was disclosed on January 24, 2026, and is patched in commit 78eab31 (v0.9-rc3). It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-674 (Uncontrolled Recursion): the lookup_handle_cname function in avahi-core/browse.c did not check for CNAME loops before recursively following CNAME records. When a self-referential CNAME record (alias == canonical name) is received and cached, the function calls itself indefinitely, exhausting the call stack and causing a segmentation fault. The vulnerability specifically affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly — a flag used by resolvers in nss-mdns. The fix (commit 78eab31) introduces a loop detection algorithm (cname_would_create_loop) that checks whether following a CNAME would create a cycle before proceeding (GitHub Advisory, Patch Commit, GitHub Issue).

Successful exploitation results in a denial-of-service (DoS) condition: avahi-daemon crashes with a segmentation fault, making mDNS/DNS-SD service discovery unavailable on the affected host. Because nss-mdns resolvers use the affected code path, hostname resolution for .local domains may also fail, potentially disrupting applications and services that rely on local network discovery. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability (GitHub Advisory).

1. Reconnaissance: Identify hosts on the local network running a vulnerable version of avahi-daemon (≤ v0.9-rc2) using network scanning tools such as nmap with mDNS service detection, or by passively monitoring mDNS traffic on port 5353/UDP.
2. Confirm active record browser: Verify that the target has an active mDNS record browser with AVAHI_LOOKUP_USE_MULTICAST set — this is typical when nss-mdns is in use for .local hostname resolution.
3. Craft malicious mDNS packet: Using Scapy or a similar packet crafting tool, construct an unsolicited mDNS response containing a self-referential CNAME record (e.g., h.local CNAME h.local):

   from scapy.all import *
   send(IP(dst='224.0.0.251')/UDP(sport=5353,dport=5353)/DNS(qd=[],qr=1,an=[DNSRR(rrname='h.local', type='CNAME', ttl=1, rdata='h.local')]))

4. Trigger crash: Send the packet from a host on the same local network segment. The target's avahi-daemon processes the response, enters unbounded recursion in lookup_handle_cname, exhausts the stack, and crashes with SIGSEGV.
5. Confirm DoS: Verify that avahi-daemon has crashed (e.g., mDNS queries go unanswered, systemd reports the service as failed) (GitHub Advisory, GitHub Issue).

• Network: Unsolicited mDNS responses (UDP port 5353, destination 224.0.0.251) containing CNAME records where the alias and canonical name are identical; unusual mDNS traffic from unexpected source hosts on the local network segment.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing avahi-daemon crash events with signal SIGSEGV; repeated avahi-daemon restart entries from systemd.
• Process: avahi-daemon process terminating unexpectedly; core dump files generated in the working directory of avahi-daemon (if core dumps are enabled).
• File System: Presence of core dump files (e.g., core.*) associated with the avahi-daemon process, potentially containing stack traces showing repeated lookup_handle_cname frames (GitHub Advisory).

The vulnerability is fixed in Avahi v0.9-rc3, specifically in commit 78eab31128479f06e30beb8c1cbf99dd921e2524, which introduces CNAME loop detection in lookup_handle_cname. Users should upgrade to a version of Avahi that includes this commit. Downstream distributions including Red Hat (RHSA-2026:11316), SUSE (SUSE-SU-2026:2311-1), openSUSE, and Ubuntu (USN-8269-1) have released patched packages. As a temporary workaround where immediate patching is not possible, consider applying network segmentation to restrict mDNS traffic (UDP port 5353) to trusted hosts, or disabling avahi-daemon if mDNS service discovery is not required (GitHub Advisory, Patch Commit, Red Hat Errata, Ubuntu Advisory).

The vulnerability was reported and fixed by the Avahi maintainer (evverx) and disclosed via a GitHub Security Advisory. Multiple Linux distributions — including Red Hat, SUSE, openSUSE, and Ubuntu — issued security advisories and patched packages. The Yocto Project security mailing list also discussed the issue across several threads. Coverage has been limited to security aggregators and Linux security news sites, with no notable broader media attention, consistent with the moderate severity rating (GitHub Advisory, Ubuntu Advisory, SUSE Advisory).