Critical Security Update for Aardvark-DNS: Denial of Service Vulnerability
Summary
ALSA-2025:3210: Important: container-tools:rhel8 security update. Affects aardvark-dns across 3 version ranges.
< 2:1.10.1-2.module_el8.10.0+4016+efd18bf8
< 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7
< 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7
Fixed in 2:1.10.1-2.module_el8.10.0+4016+efd18bf8, 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 or 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Aardvark-DNS is a DNS proxy that allows users to resolve DNS queries through a secure and private channel. It is widely used in containerized environments to enhance DNS resolution for applications. The recent vulnerability discovered in the golang.org/x/crypto/ssh package affects the key exchange process, potentially leading to a Denial of Service (DoS) attack, which can disrupt service availability.
Vulnerability Detail
The vulnerability, identified as CVE-2025-22869, originates from a flaw in the key exchange mechanism of the golang.org/x/crypto/ssh package. This flaw can be exploited by an attacker to cause a Denial of Service, effectively making the service unavailable to legitimate users. The technical implications include the potential for resource exhaustion and service disruption, which could have severe impacts on applications relying on Aardvark-DNS for DNS resolution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update aardvark-dns-
< 2:1.10.1-2.module_el8.10.0+3901+4b80ecd72:1.10.1-2.module_el8.10.0+3901+4b80ecd7 -
< 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb72:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 -
< 2:1.10.1-2.module_el8.10.0+4016+efd18bf82:1.10.1-2.module_el8.10.0+4016+efd18bf8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can limit the exposure of the Aardvark-DNS service by implementing network-level restrictions or using firewall rules to block unauthorized access while waiting for the patch to be applied.
Conclusion
The discovery of CVE-2025-22869 in Aardvark-DNS highlights the importance of maintaining up-to-date software to prevent potential Denial of Service attacks. By applying the necessary updates and following best practices for security, users can protect their applications from this vulnerability.
See every vulnerability recorded for aardvark-dns →
FAQ
CVE-2025-22869 is a vulnerability in the golang.org/x/crypto/ssh package that can lead to a Denial of Service attack.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can cause service disruptions, leading to Denial of Service, which can affect application availability.
It is recommended to regularly check for updates and apply them promptly to mitigate vulnerabilities.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for aardvark-dns.
