Back Linuxsecurity

SUSE Avahi Addresses Moderate DoS Vulnerabilities with Fix 2026-22338

Linuxsecurity •LinuxSecurity Advisories • July 1, 2026

## This update for avahi fixes the following issues: * CVE-2026-34933: reachable assertion in `transport_flags_from_domain` can crash the `avahi-daemon` (bsc#1261546). * CVE-2026-24401: unsolicited mDNS responses containing a recursive CNAME record can crash the `avahi-daemon` (bsc#1257235). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 16.0 zypper in -t patch SUSE-SLES-16.0-1026=1 * SUSE Linux Enterprise Server for SAP applications 16.0 zypper in -t patch SUSE-SLES-16.0-1026=1 ## Package List: * SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64) * avahi-autoipd-0.8-160000.5.1

* CVE-2026-24401 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2026-24401 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2026-34933 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-34933 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

* SUSE Linux Enterprise Server 16.0

* SUSE Linux Enterprise Server for SAP applications 16.0

An update that solves two vulnerabilities can now be installed.

Announcement ID: SUSE-SU-2026:22338-1 Release Date: 2026-06-22T14:40:15Z Rating: moderate

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SUSE Avahi Vulnerabilities Addressed in Recent Updates SUSE has released updates addressing two moderate vulnerabilities in the Avahi service, affecting multiple versions of SUSE Linux. The vulnerabilities, identified as CVE-2026-34933 and CVE-2026-24401, can cause the avahi-daemon to crash under specific conditions. CVE-2026-34933 involves a reachable assertion in the `transport_flags_from_domain`, while CVE-2026-24401 deals with unsolicited mDNS responses containing a recursive CNAME record. The updates are applicable to SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2, among others. Users are advised to apply the patches using SUSE's recommended installation methods. The vulnerabilities were published earlier this year, with CVE-2026-24401 on January 24 and CVE-2026-34933 on April 3. The current status is that patches are available and users are encouraged to update their systems promptly. 2 sources 46

Extracted Entities

SUSE Avahi Addresses Moderate DoS Vulnerabilities with Fix 2026-22338

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Platforms (1)