CVE-2025-8283
published 2025-07-28CVE-2025-8283: A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may…
PriorityP414low3.7CVSS 3.1
AVNACHPRNUINSUCLINAN
EPSS
0.29%
21.2th percentile
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | netavark | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
osv3.7LOW
vendor_debian3.7LOW
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Netavark Has Possible DNS Resolve Confusion
ghsa·2025-07-28
CVE-2025-8283 [LOW] CWE-15 Netavark Has Possible DNS Resolve Confusion
Netavark Has Possible DNS Resolve Confusion
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
OSV
Netavark Has Possible DNS Resolve Confusion
osv·2025-07-28
CVE-2025-8283 [LOW] Netavark Has Possible DNS Resolve Confusion
Netavark Has Possible DNS Resolve Confusion
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
OSV
CVE-2025-8283: A vulnerability was found in the netavark package, a network stack for containers used with Podman
osv·2025-07-28·CVSS 3.7
CVE-2025-8283 [LOW] CVE-2025-8283: A vulnerability was found in the netavark package, a network stack for containers used with Podman
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
Red Hat
netavark: podman: netavark may resolve hostnames to unexpected hosts
vendor_redhat·2025-07-28·CVSS 3.7
CVE-2025-8283 [LOW] CWE-15 netavark: podman: netavark may resolve hostnames to unexpected hosts
netavark: podman: netavark may resolve hostnames to unexpected hosts
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
A vulnerability was found in the netavark package, a network sta
Debian
CVE-2025-8283: netavark - A vulnerability was found in the netavark package, a network stack for container...
vendor_debian·2025·CVSS 3.7
CVE-2025-8283 [LOW] CVE-2025-8283: netavark - A vulnerability was found in the netavark package, a network stack for container...
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
Scope: local
bookworm: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
2025-07-28
Published