The consume_labels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) via a crafted compressed DNS response with a label that points to itself.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1593 advisory.

    This advisory aggregates security fixes for the avahi SRPM in CIQ LTS 8.6. It addresses 2 CVEs:
    CVE-2006-6870, CVE-2011-1002.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0387 advisory.

    This advisory aggregates security fixes for the avahi SRPM in CIQ LTS 9.2. It addresses 5 CVEs:
    CVE-2021-3468, CVE-2011-1002, CVE-2023-1981, CVE-2006-6870, CVE-2021-3502.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes a remote denial of service problem in avahi, where attackers could cause an endless loop. (CVE-2006-6870)

A flaw was discovered in Avahi's handling of compressed DNS packets.
If a specially crafted reply were received over the network, the Avahi daemon would go into an infinite loop, causing a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The consume_labels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) via a crafted compressed DNS response with a label that points to itself.

Updated packages are patched to address this issue.

This update shoul fix CVE-2006-6870 reported in #221440.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

avahi-0.6.11-3.fc5 should fix CVE-2006-6870 - the consume_labels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) via a crafted compressed DNS response with a label that points to itself.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
364618	Rocky Linux 8.6 [CIQ] Security Update: avahi / avahi-autoipd / avahi-compat-howl / avahi-compat-howl-devel / etc Multiple Vulnerabilities (ciqsa-2026_1593)	Nessus	Rocky Linux Local Security Checks	Local	high
355748	Rocky Linux 9.2 [CIQ] Security Update: avahi / avahi-autoipd / avahi-autoipd-debuginfo / avahi-compat-howl / etc Multiple Vulnerabilities (ciqsa-2026_0387)	Nessus	Rocky Linux Local Security Checks	Local	medium
29382	SuSE 10 Security Update : avahi (ZYPP Patch Number 2986)	Nessus	SuSE Local Security Checks	Local	medium
27990	Ubuntu 5.10 / 6.06 LTS / 6.10 : avahi vulnerability (USN-402-1)	Nessus	Ubuntu Local Security Checks	Local	medium
27161	openSUSE 10 Security Update : avahi (avahi-2982)	Nessus	SuSE Local Security Checks	Local	medium
24620	Mandrake Linux Security Advisory : avahi (MDKSA-2007:003)	Nessus	Mandriva Local Security Checks	Local	medium
24186	Fedora Core 6 : avahi-0.6.16-1.fc6 (2007-019)	Nessus	Fedora Local Security Checks	Local	medium
24185	Fedora Core 5 : avahi-0.6.11-3.fc5 (2007-018)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2006-6870

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium