Resource Exhaustion The advisory has been revoked - it doesn't affect any version of package avahi (opens in a new tab)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UBUNTU2510-AVAHI-14541976
- published6 Jan 2026
- disclosed18 Dec 2025
Introduced: 18 Dec 2025
CVE-2025-59529 (opens in a new tab)Amendment
The Ubuntu security team deemed this advisory irrelevant for Ubuntu:25.10.
NVD Description
Note: Versions mentioned in the description apply only to the upstream avahi package and not the avahi package as distributed by Ubuntu.
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although CLIENTS_MAX is defined, server_work() unconditionally accept()s and client_new() always appends the new client and increments n_clients. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve *.local. names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket /run/avahi-daemon/socket, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-59529
- https://github.com/avahi/avahi/pull/808
- https://github.com/avahi/avahi/security/advisories/GHSA-73wf-3xmj-x82q
- https://zeropath.com/blog/avahi-simple-protocol-server-dos-cve-2025-59529
- http://www.openwall.com/lists/oss-security/2025/12/19/1