The vulnerability in netavark occurs due to the removal of the dns.podman search domain, which leads containers to rely on the host's DNS resolver configuration. When a container is created with a specific name, that name is used as the container's hostname. Because the podman search domain is no longer appended, DNS resolution uses the host's search domains. If any of these domains contain a name matching the container's hostname, DNS queries may be redirected to external servers, resulting in external control of system or configuration settings.

The impact is limited to potential information leakage or redirection of DNS queries to external servers, which may lead to unintended network communication. The CVSS score of 3.7 (low severity) reflects limited confidentiality impact and no integrity or availability impact. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-8283 for current remediation guidance. No official fix or patch links are provided in the advisory content. Until a patch is available, users should be aware of the DNS resolution behavior and consider isolating container DNS configurations or avoiding container hostnames that could match external domains in the host's search domains.