CVE-2026-35406 PUBLISHED

Aardvark-dns has incorrect error handling for malformed tcp packets

Assigner: GitHub_M
Reserved: 02.04.2026 Published: 07.04.2026 Updated: 07.04.2026

Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU. This vulnerability is fixed in 1.17.1.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.2

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	containers
Product	aardvark-dns
Versions	Version >= 1.16.0, < 1.17.1 is affected

References

https://github.com/containers/aardvark-dns/security/advisories/GHSA-hfpq-x728-986j
https://github.com/containers/aardvark-dns/commit/3b49ea7b38bdea134b7f03256f2e13f44ce73bb1
https://github.com/containers/aardvark-dns/releases/tag/v1.17.1

Problem Types

CWE-400: Uncontrolled Resource Consumption CWE