Aardvark-dns, an authoritative DNS server for container-hosted A/AAAA records, can enter an unrecoverable infinite error loop that consumes 100 % CPU when it receives a truncated TCP DNS query followed by a connection reset. This defect threatens availability by preventing the server from processing legitimate requests until a restart or manual intervention resumes service. The weakness stems from improper error handling (CWE‑400) and missing loop termination (CWE‑835).

Any instance of the Containers project’s aardvark-dns container image labeled containers:aardvark-dns running a version between 1.16.0 and 1.17.0 inclusive is vulnerable. Operators should verify the image tag in use and ensure it is not one of these versions.

The CVSS score of 6.2 indicates moderate severity, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote client sending a malformed TCP DNS packet, which does not require local privileges. Repeated delivery of such packets can repeatedly trigger the infinite loop, exhausting CPU resources and causing a denial of service until the container is restarted or the software upgraded.