CVE catalog
CVE-2024-8418
aardvark-dns: CVE-2024-8418
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.81% · Oct 25, 2026
A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | aardvark-dns | sid | 1.17.1-3 | fixed |
| Debian | aardvark-dns | forky | 1.17.1-3 | fixed |
| Debian | aardvark-dns | trixie | 1.14.0-3 | fixed |
| Debian | aardvark-dns | bookworm | 1.4.0-3 | not affected |
| Cpe | aardvark-dns | Not reported | Not reported | unknown |
| Opensuse | aardvark-dns | tumbleweed | 1.12.2-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | aardvark-dns | source | sid | 1.12.2-1 | not yet assigned | Not reported | [1080964] |
| Debian | aardvark-dns | source | forky | 1.12.2-1 | not yet assigned | Not reported | [1080964] |
| Debian | aardvark-dns | source | trixie | 1.12.2-1 | not yet assigned | Not reported | [1080964] |
| Debian | aardvark-dns | source | bookworm | Not affected | unimportant | Not reported | [1080964] |
| Opensuse | aardvark-dns | rpm | tumbleweed | 1.12.2-1.1 | Not reported | OPENSUSE-SU-2024:14319-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [aardvark-dns]Not affected
Details (2)
1.4.0-3· amd64 · bookwormNot affected
dsa · aardvark-dns · debian · bookworm
1.4.0-3· arm64 · bookwormNot affected
dsa · aardvark-dns · debian · bookworm
[Debian 13 (Trixie)]
- [aardvark-dns]Fixed
Details (2)
1.14.0-3· amd64 · trixieFixed · Fixed:
1.12.2-1dsa · aardvark-dns · debian · 13
1.14.0-3· arm64 · trixieFixed · Fixed:
1.12.2-1dsa · aardvark-dns · debian · 13
[openSUSE Tumbleweed]
- [aardvark-dns]Fixed
Source package: [aardvark-dns]
Details (1)
2.0.0-1.2· x86_64 · tumbleweedFixed · Fixed:
1.12.2-1.1dsa · aardvark-dns · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_14319-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2024-8418]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-8418]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2024-8418]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:14319-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-8418]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-8418.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1036.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]