Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/avahi/avahi/commit/625ca0fac19229f6dfa3a6c6b698ae657187e50c
security-advisories@github.com
https://github.com/avahi/avahi/pull/891
security-advisories@github.com
https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc
security-advisories@github.com
http://www.openwall.com/lists/oss-security/2026/04/11/9
af854a3a-2127-422b-91ae-364da2661108