7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35406

CVE-2026-35406: netavark has incorrect error handling for malformed tcp packets

Impact

A truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU.

Patches

https://github.com/containers/aardvark-dns/commit/3b49ea7b38bdea134b7f03256f2e13f44ce73bb1

Workarounds

None

Credits

Thanks to @dkane01 for reporting this

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35406

CVE-2026-35406:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
netavark	rust	>= 1.16.0, <= 1.17.0	1.17.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the aardvark-dns server's handling of TCP DNS requests. Specifically, the CoreDns::handle_tcp_stream function, which is responsible for reading DNS messages from a TCP stream, enters an infinite loop if it receives a malformed packet that causes a parsing error.

The root cause is improper error handling within a loop. The function hickory_stream.next() returns a Result. In the vulnerable code, this Result was passed down to CoreDns::process_message. process_message would log the error and return, but the loop in handle_tcp_stream would not be broken. This caused the code to repeatedly attempt to read from the faulty stream, resulting in 100% CPU utilization.

The patch addresses this by checking the Result from hickory_stream.next() directly within handle_tcp_stream. If an error is present, it now logs the error and executes a break statement, terminating the loop and closing the problematic TCP connection. The signature of CoreDns::process_message was also changed to no longer accept a Result, enforcing that error handling happens at the stream-handling layer.

Therefore, during exploitation, a profiler would show high activity in CoreDns::handle_tcp_stream as it spins in the infinite loop. CoreDns::process_message would also be called repeatedly in the vulnerable version.

Vulnerable functions

CoreDns::handle_tcp_stream

src/dns/coredns.rs

The function `handle_tcp_stream` processes incoming TCP DNS requests. The vulnerability lies in the loop that reads messages from the TCP stream. When a malformed packet causes an error, the original code would call `process_message` with the error, which would log it and return. However, the loop in `handle_tcp_stream` would not terminate, causing it to repeatedly try to read from the broken stream, leading to an infinite loop and 100% CPU usage. The patch fixes this by breaking the loop when an error is encountered.

CoreDns::process_message

src/dns/coredns.rs

This function is responsible for processing the DNS message. In the vulnerable version, it received a `Result` type. While it handled the error by logging and returning, it did not signal the calling function (`handle_tcp_stream`) to terminate the connection processing loop. This allowed the infinite loop to occur. The patch changed the function signature to accept an already unwrapped `SerialMessage`, moving the error handling logic to the caller, which is the correct place to manage the stream's lifecycle.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.