Avahi facilitates service discovery on a local network via the mDNS/DNS‑SD protocol suite. In versions 0.9rc2 and earlier, an attacker can trigger a segmentation fault in avahi‑daemon by sending an unsolicited mDNS response that includes a recursive CNAME record where the alias and the canonical name are identical (e.g., "h.local" as a CNAME for "h.local"). This unbounded recursion in lookup_handle_cname causes stack exhaustion, leading the service to crash and resulting in a denial of service for networked services relying on local discovery.

Affected products are the Avahi service discovery daemon provided by the avahi vendor. Versions older than 0.9rc3, including 0.9rc1 and 0.9rc2, are vulnerable. The issue is present in all builds that use the mDNS/DNS‑SD protocol suite when AVAHI_LOOKUP_USE_MULTICAST is set explicitly, such as record browsers created by resolvers used by nss‑mdns.

The CVSS base score is 6.5, indicating a medium severity vulnerability. The EPSS score is below 1%, suggesting a low likelihood of exploitation but not zero. The vulnerability is not listed in CISA's KEV catalog. An attacker would need to send a crafted unsolicited mDNS response containing a recursive CNAME record to a machine running the vulnerable Avahi daemon on the same local network, which can be achieved by simple network traffic injection or spoofing. If executed, the attack causes a crash of the daemon, disrupting local service discovery.