CVE-2026-69186

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP. (CVE-2026-33630) CPU-exhaustion denial of service via unbounded DNS name compression pointer chains. (CVE-2026-69184) Memory-amplification denial of service via unvalidated DNS header record counts. (CVE-2026-69186)

These are all security issues fixed in the c-ares-devel-1.34.8-1.1 package on the GA media of openSUSE Tumbleweed.

This update for c-ares fixes the following issues:

Updat to c-ares 1.36.8.

• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• For details, see https://c-ares.org/changelog.html.

This update for c-ares fixes the following issues:

Update to c-ares 1.34.8.

• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).
• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• c-ares 1.34.8:
  • For details, see https://c-ares.org/changelog.html.
• c-ares 1.34.6:
  • Ignore Windows IDN Search Domains until proper IDN support is added.
  • Various bug fixes.
• c-ares 1.34.4:
  • Changes:
    • QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938
  • Bugfixes:
    • Empty TXT records were not being preserved. PR #922
    • docs: update deprecation notices for ares_create_query() and ares_mkquery(). PR #910
    • license: some files weren't properly updated. PR #920
    • Fix bind local device regression from 1.34.0. PR #929, PR #931, PR #935
    • CMake: set policy version to prevent deprecation warnings. PR #932
    • CMake: shared and static library names should be the same on unix platforms like autotools uses. PR #933
    • Update to latest autoconf archive macros for enhanced system compatibility. PR #936
• c-ares 1.34.3:
  • Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906
  • Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911
  • TSAN warns on missing lock, but lock isn't actually necessary. PR #915
  • ares_getaddrinfo() for AF_UNSPEC should retry IPv4 if only IPv6 is received. 765d558
  • ares_send() shouldn't return ARES_EBADRESP, its ARES_EBADQUERY. 91519e7
  • Fix typos in man pages. PR #905
• c-ares 1.34.2:
  • Features:
    • adig: read arguments from adigrc. [PR #856]
    • Add new pending write callback optimization via ares_set_pending_write_cb. [PR #857]
    • New function ares_process_fds(). [PR #875]
    • Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]
    • adig: rework command line arguments to mimic dig from bind. [PR #890]
    • Add new method for overriding network functions ares_set_socket_function_ex() to properly support all new functionality. [PR #894]
    • Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]
    • ares_socket: set IP_BIND_ADDRESS_NO_PORT on ares_set_local_ip* tcp sockets [PR #887]
    • URI parser/writer for ares_set_servers_csv()/ares_get_servers_csv(). [PR #882]
    • Connection handling modularization. [PR #857], [PR #876]
    • Expose library/utility functions to tools. [PR #860]
    • Remove ares__ prefix, just use ares_ for internal functions. [PR #872]
    • fix: potential WIN32_LEAN_AND_MEAN redefinition. [PR #869]
    • Fix googletest v1.15 compatibility. [PR #874]
    • Fix pkgconfig thread dependencies. [PR #884]
• c-ares 1.33.0:
  • Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]
  • Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]
  • Reorganize source tree. [PR #822]
  • Refactoring of connection handling to prevent code duplication. [PR #839]
  • New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]
  • ares_destroy() race condition during shutdown due to missing lock. [PR #831]
• c-ares in 1.32:
  • Add support for DNS 0x20 to help prevent cache poisoning attacks, enabled by specifying…

This update for c-ares fixes the following issues:

Update to c-ares 1.34.8.

• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).
• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• c-ares 1.34.8:
  • For details, see https://c-ares.org/changelog.html.
• c-ares 1.34.6:
  • Ignore Windows IDN Search Domains until proper IDN support is added.
  • Various bug fixes.
• c-ares 1.34.4:
  • Changes:
    • QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938
  • Bugfixes:
    • Empty TXT records were not being preserved. PR #922
    • docs: update deprecation notices for ares_create_query() and ares_mkquery(). PR #910
    • license: some files weren't properly updated. PR #920
    • Fix bind local device regression from 1.34.0. PR #929, PR #931, PR #935
    • CMake: set policy version to prevent deprecation warnings. PR #932
    • CMake: shared and static library names should be the same on unix platforms like autotools uses. PR #933
    • Update to latest autoconf archive macros for enhanced system compatibility. PR #936
• c-ares 1.34.3:
  • Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906
  • Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911
  • TSAN warns on missing lock, but lock isn't actually necessary. PR #915
  • ares_getaddrinfo() for AF_UNSPEC should retry IPv4 if only IPv6 is received. 765d558
  • ares_send() shouldn't return ARES_EBADRESP, its ARES_EBADQUERY. 91519e7
  • Fix typos in man pages. PR #905
• c-ares 1.34.2:
  • Features:
    • adig: read arguments from adigrc. [PR #856]
    • Add new pending write callback optimization via ares_set_pending_write_cb. [PR #857]
    • New function ares_process_fds(). [PR #875]
    • Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]
    • adig: rework command line arguments to mimic dig from bind. [PR #890]
    • Add new method for overriding network functions ares_set_socket_function_ex() to properly support all new functionality. [PR #894]
    • Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]
    • ares_socket: set IP_BIND_ADDRESS_NO_PORT on ares_set_local_ip* tcp sockets [PR #887]
    • URI parser/writer for ares_set_servers_csv()/ares_get_servers_csv(). [PR #882]
    • Connection handling modularization. [PR #857], [PR #876]
    • Expose library/utility functions to tools. [PR #860]
    • Remove ares__ prefix, just use ares_ for internal functions. [PR #872]
    • fix: potential WIN32_LEAN_AND_MEAN redefinition. [PR #869]
    • Fix googletest v1.15 compatibility. [PR #874]
    • Fix pkgconfig thread dependencies. [PR #884]
• c-ares 1.33.0:
  • Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]
  • Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]
  • Reorganize source tree. [PR #822]
  • Refactoring of connection handling to prevent code duplication. [PR #839]
  • New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]
  • ares_destroy() race condition during shutdown due to missing lock. [PR #831]
• c-ares in 1.32:
  • Add support for DNS 0x20 to help prevent cache poisoning attacks, enabled by specifying…

This update for c-ares fixes the following issues:

Updat to c-ares 1.36.8.

• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• For details, see https://c-ares.org/changelog.html.

This update for c-ares fixes the following issues:

• CVE-2024-25629: out of bounds read in ares__read_line() (bsc#1220279).
• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
• CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: Memory-amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• updated to 1.36.8.

It was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-22217)

It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2022-4904)

It was discovered that c-ares did not properly limit DNS compression pointer hops or assembled name lengths when parsing DNS names. A remote attacker could possibly use this issue to cause c-ares to use excessive resources, resulting in a denial of service. (CVE-2026-69184)

It was discovered that c-ares did not properly validate record count fields before allocating memory when parsing DNS responses. A remote attacker could possibly use this issue to cause c-ares to use excessive resources, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-69186)