CVE-2026-35406: netavark has incorrect error handling for malformed tcp packets

April 7, 2026 (updated April 24, 2026)

A truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU.

References

github.com/advisories/GHSA-hfpq-x728-986j
github.com/containers/aardvark-dns/commit/3b49ea7b38bdea134b7f03256f2e13f44ce73bb1
github.com/containers/aardvark-dns/releases/tag/v1.17.1
github.com/containers/aardvark-dns/security/advisories/GHSA-hfpq-x728-986j
nvd.nist.gov/vuln/detail/CVE-2026-35406

Code Behaviors & Features

Detect and mitigate CVE-2026-35406 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →