CVE-2026-35406

MediumCVSS 6.2

Published: 07/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

Summary

Aardvark-dns versions 1.16.0 to 1.17.0 have a vulnerability where a truncated TCP DNS query followed by a connection reset causes an infinite error loop at 100% CPU usage.

Risk Assessment

An attacker can cause complete CPU exhaustion on the DNS server, leading to denial of service for all DNS queries.

Recommendation

Upgrade aardvark-dns to version 1.17.1 or later.

Original NVD description (English source)

Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU. This vulnerability is fixed in 1.17.1.