CVE-2026-34933: 
Avahi vulnerability analysis and mitigation

CVE-2026-34933 is a Denial of Service vulnerability in Avahi, a system that facilitates service discovery on local networks via the mDNS/DNS-SD protocol suite. Discovered on 2026-03-10 by Guillaume MEUNIER (Head of VOC France, Orange Cyberdefense) and publicly disclosed on 2026-04-01, it affects all Avahi versions up to and including 0.8 and 0.9-rc3. Any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Openwall OSS-Sec).

The root cause (CWE-617: Reachable Assertion) lies in a mismatch between two separate validation layers in Avahi's flag handling. The AVAHI_FLAGS_VALID() macro at entry.c:201-209 and entry.c:593-597 validates that no unknown flag bits are set, but does not check for mutually exclusive flag combinations. The AVAHI_PUBLISH_USE_MULTICAST (0x100) and AVAHI_PUBLISH_USE_WIDE_AREA (0x80) flags are both individually permitted by this macro, yet are mutually exclusive. When both are set simultaneously (flags = 0x180), the function transport_flags_from_domain() at entry.c:57 triggers a fatal assert(), causing avahi-daemon to abort with SIGABRT. The D-Bus system bus policy (avahi-dbus.conf) allows any local user to invoke the affected EntryGroup methods — AddService, AddServiceSubtype, AddAddress, AddRecord, and UpdateServiceTxt — without restriction, making exploitation trivially accessible to any local unprivileged user (GitHub Advisory, GitHub PR #891).

Successful exploitation causes an immediate crash of the avahi-daemon process, rendering all mDNS/DNS-SD service discovery on the host unavailable. Applications relying on nss-mdns for .local hostname resolution will fail, and network service discovery for devices such as printers, Chromecast, and AirPlay stops functioning. Although systemd will auto-restart the daemon, an attacker can repeatedly trigger the crash to maintain a persistent Denial of Service condition. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory).

1. Prerequisite: Obtain any unprivileged local user account on a Linux system running avahi-daemon version ≤ 0.8 or 0.9-rc1 through 0.9-rc3.
2. Install dependency: Ensure the python3-dbus library is available (apt install python3-dbus or equivalent).
3. Connect to D-Bus: Using the Python dbus module, connect to the system D-Bus and obtain a reference to the org.freedesktop.Avahi.Server interface at path /.
4. Create an EntryGroup: Call server.EntryGroupNew() to obtain a new entry group path, then create a D-Bus interface object for org.freedesktop.Avahi.EntryGroup at that path.
5. Send conflicting flags: Call eg.AddService() with the flags parameter set to 0x180 (bitwise OR of AVAHI_PUBLISH_USE_WIDE_AREA (0x80) and AVAHI_PUBLISH_USE_MULTICAST (0x100)), along with any valid service name, type, and port.
6. Daemon crashes: The conflicting flags bypass AVAHI_FLAGS_VALID() validation but trigger the assert() in transport_flags_from_domain() at entry.c:57, causing avahi-daemon to abort with SIGABRT (exit status 134).
7. Persistent DoS: Repeat the script call after each systemd-triggered restart to maintain a continuous Denial of Service condition (GitHub Advisory, Openwall OSS-Sec).

• Logs (journald/systemd): journalctl -u avahi-daemon showing entry.c:57: transport_flags_from_domain: Assertion '!((*flags & AVAHI_PUBLISH_USE_MULTICAST) && (*flags & AVAHI_PUBLISH_USE_WIDE_AREA))' failed.
• Logs (systemd): avahi-daemon.service: Main process exited, code=exited, status=134/n/a indicating SIGABRT termination.
• Logs (systemd): Repeated avahi-daemon.service restart events in a short time window, suggesting automated crash-loop exploitation.
• Process: Unexpected termination of the avahi-daemon process followed by rapid systemd-triggered restarts.
• D-Bus: D-Bus audit logs (if enabled) showing calls to org.freedesktop.Avahi.EntryGroup methods (AddService, AddRecord, AddAddress, AddServiceSubtype, UpdateServiceTxt) with flags value 0x180 (384 decimal) from non-root local users (GitHub Advisory, Openwall OSS-Sec).

Upgrade Avahi to version 0.9-rc4 or later, which replaces the fatal assert() with a proper input validation check that refuses conflicting flag combinations before they reach transport_flags_from_domain() (GitHub PR #891, GitHub Commit). Downstream distributions including Red Hat (RHSA-2026:11316), SUSE (SUSE-SU-2026:2311-1, SUSE-SU-2026:2296-1), Ubuntu (USN-8269-1), Alpine Linux, and IBM Business Automation Insights have released patched packages. As a temporary workaround where upgrading is not immediately possible, restrict local user access to the D-Bus system bus for Avahi interfaces by modifying avahi-dbus.conf to limit which users can call EntryGroup methods, and monitor avahi-daemon for unexpected restarts (GitHub Advisory, IBM Advisory).

The vulnerability was disclosed via the Openwall oss-security mailing list on 2026-04-11 by Alan Coopersmith of Oracle Solaris Engineering, who forwarded the GitHub security advisory details (Openwall OSS-Sec). The fix was merged into the Avahi master branch on 2026-04-01 by the maintainer, with rapid uptake across major Linux distributions including Alpine, Yocto/OpenEmbedded, SUSE, Red Hat, and Ubuntu. A Bluesky post from the infosec community was noted in tracking data, indicating moderate community awareness. No significant controversy or major media coverage has been identified beyond standard security advisory channels.