The vulnerability in the Zeroconf Python library, which is an instance of CWE-400: Uncontrolled Resource Consumption and CWE-770: Uncontrolled Memory Allocation, allows an unauthenticated attacker on a local network to send UDP packets to the mDNS multicast address that cause the library to store a growing dictionary of exception tracebacks. The tracebacks retain frame locals that contain the raw packet data, leading to uncontrolled memory growth. Over time this can degrade the performance of mDNS‑dependent features or cause the process to be terminated by the operating system.

Any application that imports python‑zeroconf on a system running Python 3.x and exposes mDNS discovery on a LAN interface is affected. Versions up to and including 0.149.5 are vulnerable; upgrading to 0.149.6 or later removes the bug.

The CVSS base score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. An attacker does not need special privileges; the attack is performed locally over UDP broadcasts to 224.0.0.251 or ff02::fb on port 5353. No public exploits are known, but the risk manifests as increasing memory usage or process crash on the target host.