Description
A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | containers/aardvark-dns | 1.12.0, 1.12.1 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | aardvark-dns | 1.12.2-1 | — |
| Debian 13 | aardvark-dns | 1.12.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | aardvark-dns | 2:1.14.0-1.el9 | RHSA-2025:7094 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | aardvark-dns | 2:1.14.0-1.el9 | ALSA-2025:7094 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | aardvark-dns | 2:1.14.0-1.el9 | RLSA-2025:7094 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | aardvark-dns | 1.12.2-1.1 | openSUSE-SU-2024:14319-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | aardvark-dns | 1.12.2-r0 | — |
| Alpine v3.23 | aardvark-dns | 1.12.2-r0 | — |
| Alpine v3.22 | aardvark-dns | 1.12.2-r0 | — |
| Alpine v3.21 | aardvark-dns | 1.12.2-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | aardvark-dns | 2:1.14.0-1.el9 | ELSA-2025-7094 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | aardvark-dns | >= 1.12.0, < 1.12.2 | 1.12.2 | GHSA-g5jh-57wm-p79m |
Advisories 6
- ALSA-2025:7094 Moderate: aardvark-dns security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:7094 Red Hat Security Advisory: aardvark-dns security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- openSUSE-SU-2024:14319-1 aardvark-dns-1.12.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:7094 Moderate: aardvark-dns security update Rocky Linux Security Advisories · Oct 4, 2025
- ELSA-2025-7094 Moderate: aardvark-dns security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 16, 2025
- WID-SEC-2025-1036 Red Hat Enterprise Linux (Aardvark-dns): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 13, 2025