Zeroconf is a pure Python implementation of multicast DNS service discovery. Unbounded recursion in its DNS compression‑pointer decoder causes a RecursionError when a single malformed mDNS packet with chained pointers is processed. The error propagates out of DNSIncoming.__init__, leading to sustained CPU burn, log flooding, and degraded mDNS‑dependent features for unauthenticated hosts on the local link via UDP/5353 (224.0.0.251 / ff02::fb). The flaw is exploitable by any host on the same local network and requires no authentication. Prior to version 0.149.5, DNSIncoming._decode_labels_at_offset recursed once per compression pointer; a single packet with chained pointers triggers the RecursionError. The issue is fixed in 0.149.5.

The affected package is the pure‑Python Zeroconf library. All versions prior to 0.149.5 contain the flaw. The legacy implementation is used by applications that rely on multicast DNS service discovery over UDP port 5353 on the local network.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Nevertheless the attack vector is local: any unauthenticated host on the same subnet can send a crafted packet to trigger the recursion and exhaust local resources, which may disable discovery for other services.