GHSA-rpcf-rmh6-42xr is a low-severity (CVSS 3.7) CWE-15 vulnerability in netavark. A fix is available for netavark — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-rpcf-rmh6-42xr.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
netavarkReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | netavark | all versions | 1.15.1cargo update -p netavark --precise 1.15.1 |
Affected Products
enterprise linuxredhatopenshift container platformredhatDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for netavark, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update netavark to 1.15.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-rpcf-rmh6-42xr is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This vulnerability has been rated as having a Low security impact by the Red Hat Product Security team. For an attack to be successful, the attacker needs to have control over the domains used into the host's resolv.conf and have a prior knowledge about the hostnames and connections used by the running containers.…
As a proactive mitigation, configure containers to have hostnames formatted as <name>.dns.podman. This specific naming convention will prevent aardvark-dns from forwarding these queries to external search domains, thereby reducing potential exposure or unexpected network behavior associated with such queries.Source: Red Hat security advisory for GHSA-rpcf-rmh6-42xr (CC BY 4.0)
Frequently Asked Questions
Is GHSA-rpcf-rmh6-42xr in your dependencies?
Find it across crates.io, including transitive dependencies.