Back Linuxsecurity

SUSE Linux Micro 6.2 Avahi Moderate Crash Vuln 2026-22258

Linuxsecurity •LinuxSecurity Advisories • June 29, 2026

## This update for avahi fixes the following issues: * CVE-2026-34933: reachable assertion in `transport_flags_from_domain` can crash the `avahi-daemon` (bsc#1261546). * CVE-2026-24401: unsolicited mDNS responses containing a recursive CNAME record can crash the `avahi-daemon` (bsc#1257235). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.2 zypper in -t patch SUSE-SL-Micro-6.2-1026=1 ## Package List: * SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64) * avahi-debugsource-0.8-160000.5.1 * libavahi-common3-0.8-160000.5.1 * avahi-0.8-160000.5.1 * avahi-debuginfo-0.8-160000.5.1

* CVE-2026-24401 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2026-24401 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2026-34933 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-34933 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

* SUSE Linux Micro 6.2

An update that solves two vulnerabilities can now be installed.

Announcement ID: SUSE-SU-2026:22258-1 Release Date: 2026-06-22T14:41:38Z Rating: moderate

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SUSE Avahi Vulnerabilities Addressed in Recent Updates SUSE has released updates addressing two moderate vulnerabilities in the Avahi service, affecting multiple versions of SUSE Linux. The vulnerabilities, identified as CVE-2026-34933 and CVE-2026-24401, can cause the avahi-daemon to crash under specific conditions. CVE-2026-34933 involves a reachable assertion in the `transport_flags_from_domain`, while CVE-2026-24401 deals with unsolicited mDNS responses containing a recursive CNAME record. The updates are applicable to SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2, among others. Users are advised to apply the patches using SUSE's recommended installation methods. The vulnerabilities were published earlier this year, with CVE-2026-24401 on January 24 and CVE-2026-34933 on April 3. The current status is that patches are available and users are encouraged to update their systems promptly. 2 sources 46

Extracted Entities

CVEs (2)

CVE-2026-24401 CVE-2026-34933

Platforms (1)

SUSE Linux Micro 6.2