Nixpkgs security tracker

Untriaged

Permalink CVE-2026-35406

6.2 MEDIUM

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): NONE
Availability impact (A): HIGH

created 1 week ago

Aardvark-dns has incorrect error handling for malformed tcp packets

Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU. This vulnerability is fixed in 1.17.1.

References

https://github.com/containers/aardvark-dns/security/advisories/GHSA-hfpq-x728-986j x_refsource_CONFIRM
https://github.com/containers/aardvark-dns/commit/3b49ea7b38bdea134b7f03256f2e13f44ce73bb1 x_refsource_MISC
https://github.com/containers/aardvark-dns/releases/tag/v1.17.1 x_refsource_MISC

Affected products

aardvark-dns

==>= 1.16.0, < 1.17.1

Matching in nixpkgs

pkgs.aardvark-dns

Authoritative dns server for A/AAAA container records

nixos-unstable 1.17.0
- nixpkgs-unstable 1.17.0
- nixos-unstable-small 1.17.0
nixos-25.11 1.16.0
- nixos-25.11-small 1.16.0
- nixpkgs-25.11-darwin 1.16.0

Package maintainers

@vdemeester Vincent Demeester <vincent@sbr.pm>
@saschagrunert Sascha Grunert <mail@saschagrunert.de>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.aardvark-dns

Package maintainers