aardvark-dns error in messages file

[zsoltkarman]

Issue Description

Dear Team,
We have been updated podman from 5.4.0-13.0.1.el9_6.x86_64 into 5.6.0-11.0.1.el9_7.x86_64 at multiple hosts, then randomly around 1 day each of the host has failed due run out from the disk space.
The root cause is the messages file has been fill up with the following messages:
aardvark-dns[0]: Error parsing dns message Custom { kind: BrokenPipe, error: "closed while reading message" }
This is like generated 24GB of messages in 10 minutes.
The issue is only happed if we have containers without running network mode host, like having "dedicated" podman network.

What I can see in oracle-linux repos:

5.4.0-13.0.1

https://linux.oracle.com/errata/ELSA-2025-15900.html
https://github.com/containers/podman/commits/v5.4-rhel

5.6.0-11.0.1

https://github.com/containers/podman/commits/v5.6-rhel
https://linux.oracle.com/errata/ELSA-2026-0545.html

Thanks for your help,
Regards, Zsolt

Steps to reproduce the issue

Steps to reproduce the issue

1. Update 5.4.0-13.0.1 into 5.6.0-11.0.1

Describe the results you received

Fill up the messages file

Describe the results you expected

Describe the results you expected

podman info output

podman-6:5.6.0-11.0.1.el9_7.x86_64

Podman in a container

No

Privileged Or Rootless

None

Upstream Latest Release

Yes

Additional environment details

Additional environment details

Additional information

Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting

[Luap99]

Upstream only support the latest version, if you have problems with your distro versions please contact your vendor for support instead.

Alternatively at least provide some form of reproducer so we can verify if the issue is still present in the latest version. In any case this looks like an aardvark-dns issue and not podman so I move the issue there for now.

[zsoltkarman]

Hi, This issue is still exists. The problem is the messages file is fill up the whole disk space. Means could be 24 GB in 10 mins.
2026-01-25T10:23:31.952824+00:00 server aardvark-dns[0]: Error parsing dns message Custom { kind: BrokenPipe, error: "closed while reading message" } 2026-01-25T10:23:31.952837+00:00 server aardvark-dns[0]: Error parsing dns message Custom { kind: BrokenPipe, error: "closed while reading message" } 2026-01-25T10:23:31.952849+00:00 server aardvark-dns[0]: Error parsing dns message Custom { kind: BrokenPipe, error: "closed while reading message" } 2026-01-25T10:23:31.952862+00:00 server aardvark-dns[0]: Error parsing dns message Custom { kind: BrokenPipe, error: "closed while reading message" } 2026-01-25T10:23:31.960711+00:00 server aardvark-dns[0]: Error parsing dns message Custom { kind: BrokenPipe, error: "closed while reading message" } 2026-01-25T10:23:31.960743+00:00 server aardvark-dns[0]: Error parsing dns message Custom { kind: BrokenPipe, error: "closed while reading message" } 2026-01-25T10:23:31.960758+00:00 server aardvark-dns[0]: Error parsing dns message Custom { kind: BrokenPipe, error: "closed while reading message" } 2026-01-25T10:23:31.960772+00:00 server aardvark-dns[0]: Error parsing dns message Custom { kind: BrokenPipe, error: "closed while reading messag

[zsoltkarman]

Could you pls check for me which case is generate this error message: Error parsing dns message Custom { kind: BrokenPipe, error: "closed while reading message" } ?

[Luap99]

Without a reproducer there is nothing I can do to meaningful debug this, you can grep the source yourself for the error message parsing dns message but that doesn't tell us anything useful as of why you seemingly get an EPIPE error.

[zsoltkarman]

Hi we have found the root cause.
Qualys scans cause aardvark-dns to crash.
Is there any way to make changes in the code and ignore that scan?

This is from our knowledge base:
"If you're observing that  Qualys scans cause aardvark-dns to crash, this generally indicates that the DNS server is receiving unexpected or malformed inputs that it cannot handle robustly.Why is this happening?Qualys is a widely used security scanner that aggressively tests services for known vulnerabilities, misconfigurations, and protocol deviations. Aardvark-dns crashing under a scan likely points to one of the following:The service is not handling unexpected/malformed requests gracefully (e.g., buffer overflows or unhandled exceptions). There may be underlying vulnerabilities or bugs in aardvark-dns that are exposed by rigorous testing."

Thanks ,Zsolt

[Luap99]

then please provide the request payload so we can reproduce and fix this

[SinTan1729]

I'm also facing this issue for the last few days.

Jun 25 15:01:43 elitedesk aardvark-dns[48419]: Error parsing dns message Os { code: 32, kind: BrokenPipe, message: "Broken pipe" }
Jun 25 15:01:43 elitedesk aardvark-dns[48419]: Error parsing dns message Os { code: 32, kind: BrokenPipe, message: "Broken pipe" }
Jun 25 15:01:43 elitedesk aardvark-dns[48419]: Error parsing dns message Os { code: 32, kind: BrokenPipe, message: "Broken pipe" }
Jun 25 15:01:43 elitedesk aardvark-dns[48419]: Error parsing dns message Os { code: 32, kind: BrokenPipe, message: "Broken pipe" }
Jun 25 15:01:43 elitedesk aardvark-dns[48419]: Error parsing dns message Os { code: 32, kind: BrokenPipe, message: "Broken pipe" }
Jun 25 15:01:43 elitedesk aardvark-dns[48419]: Error parsing dns message Os { code: 32, kind: BrokenPipe, message: "Broken pipe" }
Jun 25 15:01:43 elitedesk aardvark-dns[48419]: Error parsing dns message Os { code: 32, kind: BrokenPipe, message: "Broken pipe" }

It's hard to figure out what exactly is causing the issue to spark, since the logs are being drowned in hundreds of thousands of these, and old logs are being deleted. I'll try increasing my log retention to see if anything comes up.

I'm on podman version 5.8.2.

[Luap99]

Can you strace -f -p <pid of aardvark-dns> next time this happens, that should at least tell me what syscall returns the EPIPE error