Every CVE Search/ Get API key

CVE-2024-8418

Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service

7.5 HighFix available

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.81%Up 0.8 points since Sep 5, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime.

Record
CVE-2024-8418
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2024-2791 7.5

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime.

Record
EUVD-2024-2791
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-g5jh-57wm-p79m 8.7

Missing connection timeout in Aardvark-dns

A flaw was found in Aardvark-dns versions 1.12.0 and 1.12.1. They contain a denial of service vulnerability due to serial processing of TCP DNS queries. This flaw allows a malicious client to keep a TCP connection open indefinitely, causing other DNS queries to time out and resulting in a denial of service for all other containers using aardvark-dns.

Record
GHSA-g5jh-57wm-p79m
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 7.5

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime.

Record
CVE-2024-8418
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVALPINE-CVE-2024-8418 7.5

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime.

Record
ALPINE-CVE-2024-8418
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVBELL-CVE-2024-8418 7.5
Record
BELL-CVE-2024-8418
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSV 7.5

Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime.

Record
CVE-2024-8418
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVDEBIAN-CVE-2024-8418 7.5

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime.

Record
DEBIAN-CVE-2024-8418
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-g5jh-57wm-p79m 8.7

Missing connection timeout in Aardvark-dns

A flaw was found in Aardvark-dns versions 1.12.0 and 1.12.1. They contain a denial of service vulnerability due to serial processing of TCP DNS queries. This flaw allows a malicious client to keep a TCP connection open indefinitely, causing other DNS queries to time out and resulting in a denial of service for all other containers using aardvark-dns.

Record
GHSA-g5jh-57wm-p79m
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVRHSA-2025:7094 7.5

Red Hat Security Advisory: aardvark-dns security update

Record
RHSA-2025:7094
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:7094 7.5

Moderate: aardvark-dns security update

Authoritative DNS server for A/AAAA container records Forwards other request to configured resolvers. Read more about configuration in src/backend/mod.rs.

Security Fix(es):

  • containers/aardvark-dns: TCP Query Handling Flaw in Aardvark-dns Leading to Denial of Service (CVE-2024-8418)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Record
RLSA-2025:7094
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-8418 7.5

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime.

Record
UBUNTU-CVE-2024-8418
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2025:7094 No score

Moderate: aardvark-dns security update

Authoritative DNS server for A/AAAA container records Forwards other request to configured resolvers. Read more about configuration in src/backend/mod.rs.

Security Fix(es):

  • containers/aardvark-dns: TCP Query Handling Flaw in Aardvark-dns Leading to Denial of Service (CVE-2024-8418)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

Record
ALSA-2025:7094
Updated
2026-11-02
OSVopenSUSE-SU-2024:14319-1 No score

aardvark-dns-1.12.2-1.1 on GA media

These are all security issues fixed in the aardvark-dns-1.12.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14319-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aardvark-dns
crates.io
 1.12.0 up to 1.12.2
1.12.2
aardvark-dns
Alpine:v3.21
 before 1.12.2-r0
1.12.2-r0
aardvark-dns
Alpine:v3.22
 before 1.12.2-r0
1.12.2-r0
aardvark-dns
Alpine:v3.23
 before 1.12.2-r0
1.12.2-r0
aardvark-dns
Alpine:v3.24
 before 1.12.2-r0
1.12.2-r0
aardvark-dns
AlmaLinux:9
 before 2:1.14.0-1.el9
2:1.14.0-1.el9
aardvark-dns
Alpaquita:stream
 1.12.1-r0 up to 1.12.2-r0
1.12.2-r0
aardvark-dns
Debian:13
 before 1.12.2-1
1.12.2-1
aardvark-dns
Debian:14
 before 1.12.2-1
1.12.2-1
aardvark-dns
Red Hat:enterprise_linux:9::appstream
 before 2:1.14.0-1.el9
2:1.14.0-1.el9
Show 4 moreShow less
Affected packages
PackageAffectedFixed
aardvark-dns-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 2:1.14.0-1.el9
2:1.14.0-1.el9
aardvark-dns-debugsource
Red Hat:enterprise_linux:9::appstream
 before 2:1.14.0-1.el9
2:1.14.0-1.el9
aardvark-dns
Rocky Linux:9
 before 2:1.14.0-1.el9
2:1.14.0-1.el9
aardvark-dns
openSUSE:Tumbleweed
 before 1.12.2-1.1
1.12.2-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-8418 is a high vulnerability (CVSS 7.5) in Containers Aardvark-dns, published September 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.81%, the 56th percentile. Fixed in aardvark-dns 1.12.2.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open