CVE-2025-59529

{
  "id": "CVE-2025-59529",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-18T21:15:53.637",
  "lastModified": "2026-10-23T20:17:19.563",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc5, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users."
    },
    {
      "lang": "es",
      "value": "Avahi es un sistema que facilita el descubrimiento de servicios en una red local a través de la suite de protocolos mDNS/DNS-SD. En versiones hasta la 0.9-rc2 inclusive, el servidor de protocolo simple ignora el límite de clientes documentado y acepta conexiones ilimitadas, permitiendo un DoS local fácil. Aunque 'CLIENTS_MAX' está definido, 'server_work()' 'accept()'a incondicionalmente y 'client_new()' siempre añade el nuevo cliente e incrementa 'n_clients'. No hay una comprobación contra el límite. Cuando un cliente no puede ser aceptado como resultado del número máximo de sockets de avahi-daemon, registra incondicionalmente un error por cada conexión. Usuarios locales sin privilegios pueden agotar la memoria del demonio y los descriptores de archivo, causando una denegación de servicio a nivel de sistema para mDNS/DNS-SD. Agotar los descriptores de archivo locales causa una carga del sistema aumentada debido al registro de errores de cada solicitud. La sobrecarga impide las llamadas a glibc que utilizan los plugins nss-mdns para resolver nombres '*.local.' y direcciones link-local. A la fecha de publicación, no hay versiones parcheadas conocidas disponibles, pero una solución candidata está disponible en la solicitud de extracción 808, y algunas soluciones alternativas están disponibles. Se ofrecen clientes simples para la funcionalidad del paquete nss-mdns. No es posible deshabilitar el socket unix '/run/avahi-daemon/socket', pero las solicitudes de resolución recibidas a través de DBus no se ven afectadas directamente. Las herramientas avahi-resolve, avahi-resolve-address y avahi-resolve-host-name no se ven afectadas, utilizan la interfaz DBus. Es posible cambiar los permisos del socket unix después de que avahi-daemon se inicie. Pero avahi-daemon no proporciona ninguna configuración para ello. Restricciones de acceso adicionales como SELinux también pueden evitar que herramientas no deseadas accedan al socket y mantener la resolución funcionando para usuarios de confianza."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "avahi",
          "product": "avahi",
          "versions": [
            {
              "version": "<= 0.9-rc5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-18T20:41:46.401974Z",
          "id": "CVE-2025-59529",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:avahi:avahi:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.9",
              "matchCriteriaId": "6481267F-934F-4A0C-9B25-59738E798458"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:avahi:avahi:0.9:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "76971590-AEED-4CB1-B7B7-45EA8FD11524"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/avahi/avahi/pull/808",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/avahi/avahi/pull/975",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/avahi/avahi/security/advisories/GHSA-73wf-3xmj-x82q",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://zeropath.com/blog/avahi-simple-protocol-server-dos-cve-2025-59529",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/12/19/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mailing List"
      ]
    }
  ]
}