CVE-2006-6870
CVE-2006-6870 is a medium-severity vulnerability in Avahi with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.0)
- EPSS exploit prediction: 2% (81st percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Avahi
- Published:
- Last modified:
Description
The consume_labels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) via a crafted compressed DNS response with a label that points to itself.
Frequently asked questions
- What is CVE-2006-6870?
- The consume_labels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) via a crafted compressed DNS response with a label that points to itself.
- How severe is CVE-2006-6870?
- CVE-2006-6870 has a CVSS 2.0 base score of 5.0, rated medium severity.
- Is CVE-2006-6870 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (81st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2006-6870?
- CVE-2006-6870 primarily affects Avahi. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2006-6870?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2006-6870 published?
- CVE-2006-6870 was published on 2006-12-31 and last updated on 2026-06-16.
References
- http://fedoranews.org/cms/node/2362
- http://fedoranews.org/cms/node/2408
- http://secunia.com/advisories/23628
- http://secunia.com/advisories/23644
- http://secunia.com/advisories/23660
- http://secunia.com/advisories/23673
- http://secunia.com/advisories/23782
- http://secunia.com/advisories/24995
- http://www.avahi.org/#December2006
- http://www.avahi.org/changeset/1340
- http://www.avahi.org/ticket/84
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:003
- http://www.novell.com/linux/security/advisories/2007_007_suse.html
- http://www.securityfocus.com/bid/21881
- http://www.ubuntu.com/usn/usn-402-1
- http://www.vupen.com/english/advisories/2007/0071
Affected products (9)
- cpe:2.3:a:avahi:avahi:0.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:avahi:avahi:0.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:avahi:avahi:0.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:avahi:avahi:0.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:avahi:avahi:0.6.11:*:*:*:*:*:*:*
- cpe:2.3:a:avahi:avahi:0.6.12:*:*:*:*:*:*:*
- cpe:2.3:a:avahi:avahi:0.6.13:*:*:*:*:*:*:*
- cpe:2.3:a:avahi:avahi:0.6.14:*:*:*:*:*:*:*
- cpe:2.3:a:avahi:avahi:0.6.15:*:*:*:*:*:*:*
More vulnerabilities in Avahi
- CVE-2017-6519 — Critical (CVSS 9.1): avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that…
- CVE-2021-26720 — High (CVSS 7.8): avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via…
- CVE-2026-24401 — Medium (CVSS 6.5): Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In…
- CVE-2025-68471 — Medium (CVSS 6.5): Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2…
- CVE-2025-68468 — Medium (CVSS 6.5): Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2…
- CVE-2023-38473 — Medium (CVSS 6.2): A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.