CVE-2026-34933: Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.
Other sources
Avahi: Reachable assertion in transportflagsfromdomain() via conflicting publish flags crashes avahi-daemon
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
avahito a version that resolves this vulnerability.Fixed in 0.9-rc4 - Compensating control
Restrict access to the avahi-daemon D-Bus interface so unprivileged local users cannot send D-Bus method calls that use conflicting publish flags (prior to upgrading to 0.9-rc4).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34933?
CVE-2026-34933 has a high severity level due to its ability to crash the avahi-daemon, impacting service availability.
How do I fix CVE-2026-34933?
To fix CVE-2026-34933, upgrade to Avahi version 0.9-rc4 or later.
Who is affected by CVE-2026-34933?
CVE-2026-34933 affects users running Avahi versions prior to 0.9-rc4, including 0.9-rc1, 0.9-rc2, and 0.9-rc3.
What are the implications of CVE-2026-34933?
The implications of CVE-2026-34933 include local users being able to crash the avahi-daemon, leading to disruptions in network service discovery.
What component in Avahi is vulnerable due to CVE-2026-34933?
The vulnerability in CVE-2026-34933 is due to an assertion failure in the `transport_flags_from_domain()` function of avahi-daemon.