CVE-2026-48045

Affected versions of the `python-zeroconf` package are vulnerable to Denial of Service (DoS) due to unbounded memory allocation in the `AsyncListener.handle_query_or_defer` method. This method retains every truncated incoming query in `self._deferred[addr]` and initiates a timer for each address, without capping the list size or the number of distinct address keys, and performs an O(N) deduplication check on each arrival. An attacker on the local network can exploit this by sending a flood of spoofed-source, byte-distinct TC-flagged mDNS queries, leading to memory exhaustion and potential process termination on memory-constrained systems.