Critical Security Update for Aardvark-DNS: Denial of Service Vulnerabilities
Summary
ALSA-2026:63163: Important: container-tools:rhel8 security update. Affects aardvark-dns across 4 version ranges.
< 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7
< 2:1.10.1-2.module_el8.10.0+4023+db236c53
< 2:1.10.1-2.module_el8.10.0+4047+545787c4
< 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Aardvark-DNS is a DNS proxy that enhances privacy and security for users by providing DNS-over-HTTPS and DNS-over-TLS functionalities. It is part of the container-tools module in AlmaLinux 8, which includes essential tools for managing containers such as Podman, Buildah, and Skopeo. The recent vulnerabilities discovered in this module pose significant risks to applications relying on these tools.
Vulnerability Detail
The vulnerabilities identified in the container-tools module include multiple Denial of Service (DoS) issues stemming from various Go packages. These vulnerabilities arise from improper handling of inputs, leading to excessive resource consumption or application crashes. Notable vulnerabilities include CVE-2026-42499, which affects email address parsing, and CVE-2026-33818, which involves excessive recursion in XML decoding. Exploiting these vulnerabilities could allow attackers to disrupt services, leading to downtime and potential data loss.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update aardvark-dns-
< 2:1.10.1-2.module_el8.10.0+3901+4b80ecd72:1.10.1-2.module_el8.10.0+3901+4b80ecd7 -
< 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb72:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 -
< 2:1.10.1-2.module_el8.10.0+4023+db236c532:1.10.1-2.module_el8.10.0+4023+db236c53 -
< 2:1.10.1-2.module_el8.10.0+4047+545787c42:1.10.1-2.module_el8.10.0+4047+545787c4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, consider implementing rate limiting on your DNS queries to mitigate the impact of potential DoS attacks. This can help reduce the likelihood of service disruption while awaiting the patch.
Conclusion
The vulnerabilities in the container-tools module, particularly affecting Aardvark-DNS, pose significant risks that could lead to service disruptions. It is essential to update the affected packages to their patched versions promptly and consider implementing workarounds to mitigate risks until updates can be applied.
See every vulnerability recorded for aardvark-dns →
FAQ
A Denial of Service vulnerability allows an attacker to make a service unavailable by overwhelming it with requests or exploiting flaws in the software.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing workarounds such as rate limiting to reduce the risk of exploitation.
Yes, several packages including Buildah, Podman, and Skopeo are also affected. It is important to update all related packages.
Vulert monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json, providing real-time insights into potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for aardvark-dns.
