CVE-2026-35406 Aardvark-dns has incorrect error handling for malformed tcp packets

Medium 6.2 Published 7 Apr 2026 Updated 8 Apr 2026

A malformed TCP packet sequence causes the Aardvark-dns container service to enter an infinite loop, consuming all CPU resources and denying service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-35406?

CVE-2026-35406 is a medium-severity denial of service vulnerability in containers aardvark-dns, published on 7 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU. This vulnerability is fixed in 1.17.1.

Weakness: CWE-835, CWE-400

Which versions are affected by CVE-2026-35406?

2 open source packages ship an affected version, including netavark. It affects 1 product.

Package	Affected	Fixed in
`netavark` crates.io	From `1.16.0`	`1.17.1`
`netavark` crates.io	From `1.16.0`	`1.17.1`

Linux distribution packages (11)

`aardvark-dns` AlmaLinux:10	All versions	`2:1.17.1-1.el10_2`
`aardvark-dns` AlmaLinux:9	All versions	`2:1.17.1-1.el9_8`
`aardvark-dns` Red Hat:enterprise_linux:10.2	All versions	`2:1.17.1-1.el10_2`
`aardvark-dns-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`2:1.17.1-1.el10_2`
`aardvark-dns-debugsource` Red Hat:enterprise_linux:10.2	All versions	`2:1.17.1-1.el10_2`
`aardvark-dns` Red Hat:enterprise_linux:9::appstream	All versions	`2:1.17.1-1.el9_8`
`aardvark-dns-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`2:1.17.1-1.el9_8`
`aardvark-dns-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`2:1.17.1-1.el9_8`
`aardvark-dns` Rocky Linux:10	All versions	`2:1.17.1-1.el10_2`
`aardvark-dns` Rocky Linux:9	All versions	`2:1.17.1-1.el9_8`
`aardvark-dns` openSUSE:Tumbleweed	All versions	`1.17.1-1.1`

Products include Containers Aardvark-Dns.

How do I fix CVE-2026-35406?

Upgrade netavark to 1.17.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-35406 being exploited?

There is no known exploitation of CVE-2026-35406 in the wild and no public exploit code.

CVE-2024-8418 Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service High 7.5

Sources

Also known as ALSA-2026:36318, ALSA-2026:36782, BELL-CVE-2026-35406, DEBIAN-CVE-2026-35406, GHSA-hfpq-x728-986j, RHSA-2026:36318 and 5 more.