Critical Security Update for Aardvark-DNS: Addressing CPU and Memory Vulnerabilities
Summary
ALSA-2026:4672: Important: container-tools:rhel8 security update. Affects aardvark-dns across 4 version ranges.
< 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7
< 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe
< 2:1.10.1-2.module_el8.10.0+4047+545787c4
< 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Aardvark-DNS is a DNS proxy that provides DNS resolution for applications running in containers. It is part of the container-tools module in AlmaLinux, which includes essential tools for managing containerized applications. The recent vulnerabilities identified in this package can lead to excessive CPU consumption and memory exhaustion, impacting the performance and stability of applications relying on it.
Vulnerability Detail
The vulnerabilities stem from issues in the golang libraries used by Aardvark-DNS. Specifically, CVE-2025-61728 allows for excessive CPU consumption when building an archive index, while CVE-2025-61726 can lead to memory exhaustion during query parameter parsing. Additionally, CVE-2025-68121 introduces unexpected session resumption in crypto/tls, potentially compromising secure communications. These vulnerabilities can be exploited by attackers to degrade service performance or disrupt operations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update aardvark-dns-
< 2:1.10.1-2.module_el8.10.0+3901+4b80ecd72:1.10.1-2.module_el8.10.0+3901+4b80ecd7 -
< 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb72:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 -
< 2:1.10.1-2.module_el8.10.0+4047+545787c42:1.10.1-2.module_el8.10.0+4047+545787c4 -
< 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe2:1.10.1-2.module_el8.10.0+4089+ce72bbbe
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can limit the resources allocated to Aardvark-DNS to mitigate the impact of these vulnerabilities. This can be done by adjusting the container's resource limits in your orchestration tool (e.g., Kubernetes) or by modifying the service configuration directly.
Conclusion
The vulnerabilities in Aardvark-DNS pose significant risks to applications relying on this DNS proxy. It is crucial to update to the patched version to ensure the security and stability of your containerized applications. Implementing workarounds can help mitigate the impact until updates are applied.
See every vulnerability recorded for aardvark-dns →
FAQ
The main vulnerabilities include excessive CPU consumption (CVE-2025-61728), memory exhaustion (CVE-2025-61726), and unexpected session resumption in TLS (CVE-2025-68121).
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities in real-time.
If immediate updates are not possible, consider implementing resource limits to mitigate the impact of the vulnerabilities until a proper update can be applied.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be leveraged to degrade service performance or disrupt operations.
Detailed information about the vulnerabilities can be found on the respective CVE pages: CVE-2025-61726, CVE-2025-61728, and CVE-2025-68121.
Related vulnerabilities
Recent vulnerabilities recorded for aardvark-dns.
