CVE-2026-35406

A flaw was found in aardvark-dns where a specially crafted TCP DNS query followed by a connection reset can trigger an infinite error loop, leading to 100% CPU usage and a denial of service. As aardvark-dns is only accessible via internal Podman networks, this issue can be exploited by a local container with network access.

This vulnerability is evaluated as having a Moderate severity because the affected service is only exposed locally within user-defined Podman container networks, preventing untrusted remote network exploitation. An attacker must already control a container running on the internal network to deliver the malformed TCP traffic required to hang the process. While successful exploitation results in complete CPU exhaustion and halts container name resolution, the blast radius is confined to host resources and container network DNS availability without compromising data integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

As a mitigation, avoid using aardvark-dns when container name resolution is not required by creating Podman networks with DNS disabled (e.g., podman network create --disable-dns). This prevents the vulnerable component from being used.