AsyncListener.handle_query_or_defer in the python‑zeroconf library retained every truncated TC‑bit upstream query, up to 8,966 bytes each, in its internal _deferred queue and armed per‑address timers, without capping the per‑address list or distinct address keys. This allowed an unauthenticated host on the local network, via UDP port 5353, to spoof source addresses and flood the service with such packets. The resulting unbounded accumulation of queued messages and timers can exhaust available memory and cause quadratic CPU usage, effectively denying service to legitimate users on the local link. The flaw is classified as CWE‑770 (Uncontrolled Resource Consumption) and was fixed in version 0.149.12.

The vulnerability was present in all releases of the python‑zeroconf library prior to version 0.149.12. System administrators using the python‑zeroconf:python‑zeroconf implementation, regardless of the host platform, are potentially exposed. Updating to 0.149.12 or a later release resolves the issue.

With a CVSS score of 6.5 the vulnerability poses a moderate risk. The EPSS score is less than 1 %, indicating a very low probability of exploitation in the general population. The issue has not been listed in the CISA KEV catalog. The attack vector is local network traffic over UDP port 5353 (mDNS/multicast). An attacker only needs to send crafted UDP packets from a local address and can do so without authentication or elevated privileges. The exploit cost is low, but the impact is significant for the affected system.