The Zeroconf library implements multicast DNS service discovery in pure Python. Before version 0.149.7, each mDNS response was accepted by the DNSCache._async_add method and stored without any limits in the cache, the expirations list, the expire heap, and the service_cache. This unbounded growth allows any host on the local network to send crafted mDNS responses with unique names, causing the process's memory to grow until exhaustion. The result is slower cache lookups, delayed async expiration processing, and broken service discovery, registration, and callback functionality.

The vulnerable code is in the python-zeroconf library, version numbers prior to 0.149.7. Any Python application that imports python-zeroconf and uses the Zeroconf service discovery on a local network is affected.

The CVSS score of 6.5 reflects moderate severity, while the EPSS score of less than 1% and the absence from the CISA KEV catalog indicate a low likelihood of widespread exploitation. Attackers would need local network access to craft and send repeated mDNS responses over UDP port 5353. If successful, the affected process could consume excessive memory until it fails, resulting in a denial of service on the local host.