CVE-2026-34933 — Reachable Assertion in Avahi

CWE-617 — Reachable AssertionCWE-1288 — Improper Validation of Consistency within Input12 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 94.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
AvahiDebian AvahiMsrc Azl3 Avahi 0.8-7 ON Azure Linux 3.0+1 more
Timeline
PublishedApr 3

Description

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5avahi/avahi< 0.9-rc4
▶NVDavahi/avahi< 0.9+1
▶debiandebian/avahi

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
OSV
CVE-2026-34933: Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite↗2026-04-03
▶

📋Vendor Advisories

3
Red Hat
avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call↗2026-04-03
▶
Microsoft
Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon↗2026-04-02
▶
Debian
CVE-2026-34933: avahi - Avahi is a system which facilitates service discovery on a local network via the...↗2026
▶

🕵️Threat Intelligence

6
Wiz
CVE-2026-34933 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2025-59529 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2025-68276 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2025-68471 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2025-68468 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

1
Bugzilla
CVE-2026-34933 avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call↗2026-04-03
▶