CVE-2026-35406: 
Rust vulnerability analysis and mitigation

CVE-2026-35406 is a denial-of-service vulnerability in aardvark-dns, the DNS server component used by Podman/Netavark container networking, caused by incorrect error handling for malformed TCP packets. When a truncated TCP DNS query is sent followed by a connection reset, aardvark-dns enters an unrecoverable infinite error loop consuming 100% CPU. The vulnerability affects aardvark-dns versions 1.16.0 through 1.17.0; versions prior to 1.16.0 are unaffected. It was disclosed on April 7, 2026, with a patch released the same day. The CVSS v3.1 base score is 7.5 (High) per the GitHub Advisory Database (Github Advisory, Release Notes).

The root cause is improper error handling in the TCP DNS stream processing loop within src/dns/coredns.rs (CWE-400: Uncontrolled Resource Consumption; CWE-835: Loop with Unreachable Exit Condition). When the TCP stream returns an error — such as when a client sends a length-prefixed DNS message header (e.g., \x00\x3c indicating 60 bytes) but then closes the connection before sending the body — the error was previously passed into process_message() where it was silently discarded, causing the loop to retry indefinitely rather than aborting the stream. The fix (commit 3b49ea7) ensures that on a stream parse error, the TCP connection is broken out of rather than retried, and error handling is moved upstream before process_message() is called (Github Advisory, Patch Commit).

Successful exploitation causes aardvark-dns to spin at 100% CPU in an infinite loop, resulting in a complete denial of DNS resolution services for all containers relying on the affected aardvark-dns instance. This disrupts container networking in Podman environments, potentially causing cascading failures in containerized workloads that depend on DNS for service discovery. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue (Github Advisory, Release Notes).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.014% (3rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack is straightforward to reproduce using standard tools such as socat to send a crafted truncated TCP DNS packet, as demonstrated in the patch's test suite (Patch Commit).

1. Identify target: Locate a host running Podman with aardvark-dns versions 1.16.0–1.17.0 active as the container DNS resolver, listening on TCP port 53 of the container network gateway IP.
2. Craft malformed TCP DNS packet: Prepare a TCP payload consisting of only the two-byte DNS-over-TCP length prefix (e.g., \x00\x3c, indicating a 60-byte message) without the actual DNS message body.
3. Send packet and reset connection: Using a tool such as socat, connect to the aardvark-dns TCP port and send the truncated length header, then immediately close the connection: socat - TCP4:<gateway_ip>:53 <<<$'\x00\x3c'
4. Trigger infinite loop: The abrupt connection close causes aardvark-dns to receive a stream error. Due to the missing error handling, the process re-enters the loop without breaking out, spinning at 100% CPU.
5. Observe DoS: DNS resolution for all containers on the affected network fails as the aardvark-dns process is fully consumed by the infinite loop, disrupting container networking (Patch Commit, Github Advisory).

• Process: The aardvark-dns process consuming sustained 100% CPU (observable via ps -o c -p <pid> or top); the process remains running but unresponsive to DNS queries.
• Network: Short-lived TCP connections to port 53 of the container gateway IP that send only 2 bytes and immediately close; repeated such connections from the same source may indicate deliberate exploitation.
• Logs: Debug log entries from aardvark-dns such as Error parsing dns message appearing in rapid succession without corresponding successful DNS resolutions; absence of normal DNS query processing logs despite active containers.
• Application behavior: Container DNS resolution failures (e.g., dig or application DNS lookups timing out) while the aardvark-dns process is still running (Patch Commit).

Upgrade aardvark-dns to version 1.17.1 or later, which was released on April 7, 2026, and contains the fix in commit 3b49ea7 (Release Notes, Github Advisory). No workarounds are available; the vendor explicitly states none exist. As a defense-in-depth measure, restrict network access to the aardvark-dns TCP port 53 on container gateway interfaces to trusted container namespaces only, reducing the attack surface until patching is possible.

The vulnerability was reported by community contributor @dkane01 and patched by maintainer Paul Holzinger (Luap99) on the same day it was disclosed, April 7, 2026, reflecting a responsive disclosure process (Github Advisory). The OpenSUSE security announce mailing list subsequently published an advisory covering the fix as part of broader container tooling updates (OpenSUSE Advisory). No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.