CVE-2026-35406
Medium · 6.2CVSS
6.2
EPSS
0.5%
Published
Apr 7, 2026
CISA due date
—
The record
Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU. This vulnerability is fixed in 1.17.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | netavark | 1.16.0 | 1.17.1 |
| openSUSE:Tumbleweed | aardvark-dns | 0 | 1.17.1-1.1 |
Related vulnerabilities
- GHSA-hfpq-x728-986j netavark has incorrect error handling for malformed tcp packets Same vulnerability
- CVE-2024-8418 A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due… Also affects aardvark-dns
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-400
- CVE-2026-83400 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-400
- CVE-2026-112400 Pillow is a Python imaging library. CWE-400
- CVE-2026-111766 markdown-it is a Markdown parser. CWE-400
- CVE-2026-111759 markdown-it is a Markdown parser. CWE-400
- CVE-2025-52290 A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg… CWE-400