Critical Security Update for Aardvark-DNS: SSH Client Panic Vulnerability
Summary
ALSA-2026:0753: Important: container-tools:rhel8 security update. Affects aardvark-dns across 4 version ranges.
< 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7
< 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe
< 2:1.10.1-2.module_el8.10.0+4047+545787c4
< 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Aardvark-DNS is a DNS proxy that allows users to resolve DNS queries through various upstream DNS servers. It is designed to enhance privacy and security by providing a more controlled DNS resolution process. The package is part of the container-tools module, which includes essential tools for managing containers, such as podman and buildah. This vulnerability affects the Aardvark-DNS package in AlmaLinux 8, which is widely used in containerized environments.
Vulnerability Detail
The vulnerability arises from a panic in the SSH client due to an unexpected SSH_AGENT_SUCCESS response. This issue is documented as CVE-2025-47913. If exploited, it could lead to denial of service, impacting the availability of services relying on SSH for secure communications. The vulnerability is rooted in the golang.org/x/crypto/ssh/agent package, which is utilized by Aardvark-DNS for SSH agent interactions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update aardvark-dns-
< 2:1.10.1-2.module_el8.10.0+3901+4b80ecd72:1.10.1-2.module_el8.10.0+3901+4b80ecd7 -
< 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb72:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 -
< 2:1.10.1-2.module_el8.10.0+4047+545787c42:1.10.1-2.module_el8.10.0+4047+545787c4 -
< 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe2:1.10.1-2.module_el8.10.0+4089+ce72bbbe
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the use of the SSH agent in your applications that rely on Aardvark-DNS until the package is updated. This can be done by setting the SSH_AUTH_SOCK environment variable to an empty value: 'export SSH_AUTH_SOCK='.
Conclusion
The Aardvark-DNS package has a critical vulnerability that can lead to service disruptions due to a panic in the SSH client. It is essential to update to the patched version to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for aardvark-dns →
FAQ
CVE-2025-47913 is a vulnerability that causes a panic in the SSH client due to an unexpected response from the SSH agent, potentially leading to service disruptions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to denial of service, affecting the availability of applications that rely on SSH for secure communications.
Yes, a patched version of the Aardvark-DNS package is available. Updating to the latest version will resolve the vulnerability.
It is recommended to regularly check for vulnerabilities in your software dependencies, ideally on a weekly basis, to ensure your applications remain secure.
Related vulnerabilities
Recent vulnerabilities recorded for aardvark-dns.
