The vulnerability arises from an uncontrolled recursion in Avahi's lookup_handle_cname function when processing mDNS messages that contain a self‑referential CNAME record. This causes the daemon to crash with a segmentation fault, exhausting the stack and leading to a denial of service by terminating the avahi‑daemon process.

Affected products are the Avahi service discovery daemon provided by the avahi vendor. Versions 0.9rc2 and earlier, including 0.9rc1 and 0.9rc2, are vulnerable. The issue is present in all builds using the mDNS/DNS‑SD protocol suite when AVAHI_LOOKUP_USE_MULTICAST is set explicitly, such as record browsers created by resolvers used by nss-mdns.

The CVSS base score is 6.5, indicating a medium severity vulnerability. The EPSS score is below 1%, suggesting a low likelihood of exploitation but not zero. The vulnerability is not listed in CISA's KEV catalog. An attacker would need to send a crafted unsolicited mDNS response containing a recursive CNAME record to a machine running the vulnerable Avahi daemon on the same local network, which can be achieved by simple network traffic injection or spoofing. If executed, the attack causes a crash of the daemon, disrupting local service discovery.