CVE catalog

CVE-2026-34933

Avahi is a system which facilitates service discovery…

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Apr 3, 2026, 10:43:26 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.20% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "avahi",
      "status": "vulnerable",
      "release": "sid",
      "version": "0.8-18"
    },
    {
      "name": "avahi",
      "status": "vulnerable",
      "release": "forky",
      "version": "0.8-18"
    },
    {
      "name": "avahi",
      "status": "vulnerable",
      "release": "trixie",
      "version": "0.8-16"
    },
    {
      "name": "avahi",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "0.8-10+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1132712,
      "name": "avahi",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1132712,
      "name": "avahi",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1132712,
      "name": "avahi",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1132712,
      "name": "avahi",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "avahi",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "avahi-autoipd",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "avahi-daemon",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "avahi-discover",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "avahi-dnsconfd",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "avahi-ui-utils",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "avahi-utils",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "gir1.2-avahi-0.6",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-client-dev",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-client3",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-common-data",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-common-dev",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-common3",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-compat-libdnssd-dev",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-compat-libdnssd1",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-core-dev",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-core7",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-glib-dev",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-glib1",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-gobject-dev",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-gobject0",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-ui-gtk3-0",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "libavahi-ui-gtk3-dev",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "python3-avahi",
      "ecosystem": "cpe",
      "fixed_version": "0.8-13ubuntu6.2"
    },
    {
      "name": "avahi",
      "ecosystem": "cpe",
      "fixed_version": "not yet fixed"
    },
    {
      "name": "avahi",
      "ecosystem": "cpe",
      "fixed_version": "0.9"
    },
    {
      "name": "avahi",
      "ecosystem": "cpe",
      "fixed_version": ""
    },
    {
      "name": "avahi",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8-r26"
            }
          ]
        }
      ],
      "release": "3.24",
      "versions": [],
      "ecosystem": "apk",
      "fixed_version": "0.8-r26",
      "provider_record_id": "ALPINE-CVE-2026-34933"
    },
    {
      "name": "avahi",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7-4ubuntu7.3+esm2"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "0.7-4ubuntu5",
        "0.7-4ubuntu6",
        "0.7-4ubuntu7",
        "0.7-4ubuntu7.1",
        "0.7-4ubuntu7.2",
        "0.7-4ubuntu7.3",
        "0.7-4ubuntu7.3+esm1"
      ],
      "ecosystem": "deb",
      "fixed_version": "0.7-4ubuntu7.3+esm2",
      "provider_record_id": "UBUNTU-CVE-2026-34933"
    },
    {
      "name": "avahi",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8-5ubuntu5.5"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "0.8-5ubuntu4",
        "0.8-5ubuntu5",
        "0.8-5ubuntu5.1",
        "0.8-5ubuntu5.2",
        "0.8-5ubuntu5.3",
        "0.8-5ubuntu5.4"
      ],
      "ecosystem": "deb",
      "fixed_version": "0.8-5ubuntu5.5",
      "provider_record_id": "UBUNTU-CVE-2026-34933"
    },
    {
      "name": "avahi",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8-13ubuntu6.2"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "0.8-10ubuntu1",
        "0.8-13ubuntu1",
        "0.8-13ubuntu2",
        "0.8-13ubuntu4",
        "0.8-13ubuntu5",
        "0.8-13ubuntu6",
        "0.8-13ubuntu6.1"
      ],
      "ecosystem": "deb",
      "fixed_version": "0.8-13ubuntu6.2",
      "provider_record_id": "UBUNTU-CVE-2026-34933"
    },
    {
      "name": "avahi",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8-16ubuntu3.2"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "0.8-16ubuntu2",
        "0.8-16ubuntu3",
        "0.8-16ubuntu3.1"
      ],
      "ecosystem": "deb",
      "fixed_version": "0.8-16ubuntu3.2",
      "provider_record_id": "UBUNTU-CVE-2026-34933"
    },
    {
      "name": "avahi",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8-18ubuntu1.1"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "0.8-16ubuntu3",
        "0.8-17ubuntu1",
        "0.8-17ubuntu2",
        "0.8-18ubuntu1"
      ],
      "ecosystem": "deb",
      "fixed_version": "0.8-18ubuntu1.1",
      "provider_record_id": "UBUNTU-CVE-2026-34933"
    },
    {
      "name": "avahi",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8-43.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "0.8-43.1",
      "provider_record_id": "OPENSUSE-SU-2026:10670-1"
    }
  ]
}

[Debian bug #1132712]

Publisher notes

[trixie] avahi: Minor issue [bookworm] avahi: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[avahi-autoipd]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[avahi-daemon]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[avahi-discover]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · all · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · all · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[avahi-dnsconfd]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[avahi-ui-utils]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[avahi-utils]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[gir1.2-avahi-0.6]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-client3]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-client-dev]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-common3]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-common-data]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-common-dev]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-compat-libdnssd1]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-compat-libdnssd-dev]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-core7]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-core-dev]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-glib1]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-glib-dev]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-gobject0]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
[libavahi-gobject-dev]Unknown
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Affected
  nvd · avahi · debian · bookworm; nvd · avahi · debian · 12

Next results

Observed: Oct 23, 2026, 10:35:00 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]