{"id":"CVE-2026-69184","aliases":["AZL-103307","AZL-103457","BELL-CVE-2026-69184","DEBIAN-CVE-2026-69184","EUVD-2026-83213","GHSA-pjmc-gx33-gc76","MGASA-2026-0343","RHSA-2026:40574","ROOT-OS-ALPINE-320-CVE-2026-69184","SUSE-SU-2026:23364-1","SUSE-SU-2026:23414-1","SUSE-SU-2026:23597-1","SUSE-SU-2026:3872-1","SUSE-SU-2026:4021-1","UBUNTU-CVE-2026-69184","USN-8951-1","openSUSE-SU-2026:11593-1","openSUSE-SU-2026:21721-1"],"status":"published","title":"c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00479,"percentile":0.41793,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2026-08-15T06:06:33.11192Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"c-ares","fixed_in":["1.34.8-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"c-ares","fixed_in":["1.34.7-1"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"c-ares","fixed_in":["1.33.1-r00074"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-c-ares","fixed_in":["1.33.1-r00074"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"c-ares","fixed_in":["1.10.0-3ubuntu0.2+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c-ares","fixed_in":["1.14.0-1ubuntu0.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"c-ares","fixed_in":["1.15.0-1ubuntu0.5+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"c-ares","fixed_in":["1.18.1-1ubuntu0.22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"c-ares","fixed_in":["1.27.0-1.0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"c-ares","fixed_in":["1.34.6-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"fluent-bit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.10-8"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.5-r0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-r0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.5-r0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-r0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34.5-1","1.34.5-1+deb13u1","1.34.6-1","1.34.7-1","1.34.8-1"]},{"source":"osv","ecosystem":"Debian:14","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.7-1"}]}],"versions":["1.34.5-1","1.34.6-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.8-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"c-ares-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.8-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-r00074"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-r00074"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-slfo.1.1_1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-9.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-9.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-3ubuntu0.2+esm4"}]}],"versions":["1.10.0-2","1.10.0-3","1.10.0-3ubuntu0.1","1.10.0-3ubuntu0.2","1.10.0-3ubuntu0.2+esm1","1.10.0-3ubuntu0.2+esm2","1.10.0-3ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1ubuntu0.2+esm3"}]}],"versions":["1.13.0-2","1.13.0-3","1.14.0-1","1.14.0-1ubuntu0.1","1.14.0-1ubuntu0.2","1.14.0-1ubuntu0.2+esm1","1.14.0-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-1ubuntu0.5+esm1"}]}],"versions":["1.15.0-1build1","1.15.0-1ubuntu0.1","1.15.0-1ubuntu0.2","1.15.0-1ubuntu0.3","1.15.0-1ubuntu0.4","1.15.0-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu0.22.04.4"}]}],"versions":["1.17.1-1ubuntu1","1.18.1-1","1.18.1-1build1","1.18.1-1ubuntu0.22.04.1","1.18.1-1ubuntu0.22.04.2","1.18.1-1ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-1.0ubuntu1.1"}]}],"versions":["1.19.1-3","1.20.1-1","1.26.0-1","1.27.0-1","1.27.0-1.0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.6-1ubuntu0.2"}]}],"versions":["1.34.5-1","1.34.6-1","1.34.6-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-3ubuntu0.2+esm4"}]}],"versions":["1.10.0-2","1.10.0-3","1.10.0-3ubuntu0.1","1.10.0-3ubuntu0.2","1.10.0-3ubuntu0.2+esm1","1.10.0-3ubuntu0.2+esm2","1.10.0-3ubuntu0.2+esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1ubuntu0.2+esm3"}]}],"versions":["1.13.0-2","1.13.0-3","1.14.0-1","1.14.0-1ubuntu0.1","1.14.0-1ubuntu0.2","1.14.0-1ubuntu0.2+esm1","1.14.0-1ubuntu0.2+esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-1ubuntu0.5+esm1"}]}],"versions":["1.15.0-1build1","1.15.0-1ubuntu0.1","1.15.0-1ubuntu0.2","1.15.0-1ubuntu0.3","1.15.0-1ubuntu0.4","1.15.0-1ubuntu0.5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu0.22.04.4"}]}],"versions":["1.17.1-1ubuntu1","1.18.1-1","1.18.1-1build1","1.18.1-1ubuntu0.22.04.1","1.18.1-1ubuntu0.22.04.2","1.18.1-1ubuntu0.22.04.3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-1.0ubuntu1.1"}]}],"versions":["1.19.1-3","1.20.1-1","1.26.0-1","1.27.0-1","1.27.0-1.0ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.6-1ubuntu0.2"}]}],"versions":["1.34.5-1","1.34.6-1","1.34.6-1ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-160000.1.1"}]}],"bundled":3}],"products":[{"vendor":"c-ares","product":"c-ares"}],"references":[{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76","tags":["x_refsource_CONFIRM","advisory","article","report"]},{"url":"https://github.com/c-ares/c-ares/pull/1164","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/c-ares/c-ares/pull/1210","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/c-ares/c-ares/commit/5c8341ba6ff3a8e4e4dfd616f8ed0418838b8b7b","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/c-ares/c-ares/commit/f1288bbc70e9a1e0a77134c2382157e52d326aea","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/c-ares/c-ares/releases/tag/v1.34.7","tags":["x_refsource_MISC","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69184","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-69184","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69184.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-69184","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0343.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35847","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/06/8","tags":["web","report"]},{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj","tags":["advisory","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RP4OX63ZTYCCB4UK6HI4BFEPQEPSNLOJ/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40574","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69186","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69184","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40574.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538396","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69184","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538212","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69186","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/commit/e47c203f91cd8b749c8736bc18d75a31ffdec8f4","tags":["article"]},{"url":"https://github.com/c-ares/c-ares/commit/eaded4cb200b2a5f8d73f11021ff7c8d6968aaab","tags":["article"]},{"url":"https://github.com/c-ares/c-ares/pull/1134","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623364-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240955","tags":["report"]},{"url":"https://bugzilla.suse.com/1254738","tags":["report"]},{"url":"https://bugzilla.suse.com/1270416","tags":["report"]},{"url":"https://bugzilla.suse.com/1276290","tags":["report"]},{"url":"https://bugzilla.suse.com/1276291","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623414-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623597-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263872-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264021-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220279","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25629","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-69184","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8951-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-22217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4904","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-69186","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-69184","title":"c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T17:26:52.21Z","modified":"2026-09-21T20:48:59.663Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T13:50:16.178634Z"}],"euvd":[{"id":"EUVD-2026-83213","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T17:26:52Z","modified":"2026-09-21T20:48:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:04.224689Z"}],"nvd":[{"id":"CVE-2026-69184","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T18:17:11.477Z","modified":"2026-09-24T21:16:28.12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"BELL-CVE-2026-69184","status":"published","published":"2026-08-15T06:06:33.11192Z","modified":"2026-09-20T07:15:07.471792576Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:25.50888Z"},{"id":"CVE-2026-69184","title":"c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T17:26:52.21Z","modified":"2026-10-28T11:22:33.205940445Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"DEBIAN-CVE-2026-69184","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T18:17:11.477Z","modified":"2026-09-25T08:47:32.401512453Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"RHSA-2026:40574","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-26T10:08:26Z","modified":"2026-10-17T10:13:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"UBUNTU-CVE-2026-69184","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T18:17:00Z","modified":"2026-10-21T23:02:04.710512652Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"AZL-103307","title":"CVE-2026-69184 affecting package c-ares for versions less than 1.34.8-1","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T18:17:11Z","modified":"2026-11-02T14:15:40.038562555Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103457","title":"CVE-2026-69184 affecting package fluent-bit 3.1.10-8","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T18:17:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.528763Z"},{"id":"MGASA-2026-0343","title":"Updated c-ares packages fix security vulnerabilities","description":"Use-after-free / double-free in c-ares query-completion handling,\nremotely triggerable via ares_getaddrinfo() over TCP. (CVE-2026-33630)\nCPU-exhaustion denial of service via unbounded DNS name compression\npointer chains. (CVE-2026-69184)\nMemory-amplification denial of service via unvalidated DNS header record\ncounts. (CVE-2026-69186)\n","status":"published","published":"2026-08-31T16:22:02Z","modified":"2026-08-31T16:30:04.403545003Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11593-1","title":"c-ares-devel-1.34.8-1.1 on GA media","description":"These are all security issues fixed in the c-ares-devel-1.34.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-25T00:00:00Z","modified":"2026-08-26T10:15:03.389391117Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21721-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdat to c-ares 1.36.8.\n\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- For details, see https://c-ares.org/changelog.html.\n","status":"published","published":"2026-09-01T15:48:33Z","modified":"2026-09-02T18:00:03.313428309Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2026-69184","title":"CVE-2026-69184 in c-ares - Patched by Root","description":"Root has patched CVE-2026-69184 in the c-ares package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-10-07T09:08:38Z","modified":"2026-10-07T10:15:07.509798011Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"SUSE-SU-2026:23364-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdate to c-ares 1.34.8.\n\n- CVE-2025-31498: use-after-free in `read_answers()` when `process_answer()` may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- c-ares 1.34.8:\n  * For details, see https://c-ares.org/changelog.html.\n- c-ares 1.34.6:\n  * Ignore Windows IDN Search Domains until proper IDN support is added.\n  * Various bug fixes.\n- c-ares 1.34.4:\n  * Changes:\n    -  QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938\n  * Bugfixes:\n    - Empty TXT records were not being preserved. PR #922\n    - `docs`: update deprecation notices for `ares_create_query()` and `ares_mkquery()`. PR #910\n    - `license`: some files weren't properly updated. PR #920\n    - Fix `bind` local device regression from 1.34.0. PR #929, PR #931, PR #935\n    - `CMake`: set policy version to prevent deprecation warnings. PR #932\n    - `CMake`: shared and static library names should be the same on unix platforms like `autotools` uses. PR #933\n    - Update to latest `autoconf` archive macros for enhanced system compatibility. PR #936\n- c-ares 1.34.3:\n  * Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906\n  * Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911\n  * TSAN warns on missing lock, but lock isn't actually necessary. PR #915\n  * `ares_getaddrinfo(`) for `AF_UNSPEC` should retry IPv4 if only IPv6 is received. 765d558\n  * `ares_send()` shouldn't return `ARES_EBADRESP`, its `ARES_EBADQUERY`. 91519e7\n  * Fix typos in man pages. PR #905\n- c-ares 1.34.2:\n  * Features:\n    - `adig`: read arguments from `adigrc`. [PR #856]\n    - Add new pending write callback optimization via `ares_set_pending_write_cb`. [PR #857]\n    - New function `ares_process_fds()`. [PR #875]\n    - Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]\n    - `adig`: rework command line arguments to mimic `dig` from `bind`. [PR #890]\n    - Add new method for overriding network functions `ares_set_socket_function_ex()` to properly support all new\n      functionality. [PR #894]\n    - Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]\n    - `ares_socket`: set `IP_BIND_ADDRESS_NO_PORT` on `ares_set_local_ip*` tcp sockets [PR #887]\n    - URI parser/writer for `ares_set_servers_csv()`/`ares_get_servers_csv()`. [PR #882]\n    - Connection handling modularization. [PR #857], [PR #876]\n    - Expose library/utility functions to tools. [PR #860]\n    - Remove `ares__` prefix, just use `ares_` for internal functions. [PR #872]\n    - fix: potential `WIN32_LEAN_AND_MEAN` redefinition. [PR #869]\n    - Fix `googletest` v1.15 compatibility. [PR #874]\n    - Fix `pkgconfig` thread dependencies. [PR #884]\n- c-ares 1.33.0:\n  * Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]\n  * Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]\n  * Reorganize source tree. [PR #822]\n  * Refactoring of connection handling to prevent code duplication. [PR #839]\n  * New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]\n  * `ares_destroy()` race condition during shutdown due to missing lock. [PR #831]\n- c-ares in 1.32:\n  * Add support for DNS `0x20` to help prevent cache poisoning attacks, enabled by specifying `ARES_FLAG_DNS0x20`.\n    Disabled by default. [PR #800]\n  * Rework query timeout logic to automatically adjust timeouts based on network conditions. The timeout specified now\n    is only used as a hint until there is enough history to calculate a more valid timeout. [PR #794]\n  * DNS RR `TXT` strings should not be automatically concatenated as there are use cases outside of RFC 7208. In order\n    to maintain ABI compliance, the ability to retrieve `TXT` strings concatenated is retained as well as a new API to\n    retrieve the individual strings. This restores behavior from c-ares 1.20.0. [PR #801]\n  * Clean up header inclusion logic to make hacking on code easier. [PR #797]\n  * GCC/Clang: Enable even more strict warnings to catch more coding flaws. [253bdee]\n  * Tests: Fix thread race condition in test cases for `EventThread`. [PR #803]\n  * Thread Saftey: `ares_timeout()` was missing lock. [74a64e4]\n- c-ares 1.31.0:\n  * Enable Query Cache by default. [PR #786]\n  * Enhance Windows DNS configuration change detection to also detect manual DNS configuration changes. [PR #785]\n  * Various legacy MacOS Build fixes. [Issue #782]\n  * Ndots value of zero in `resolv.conf` was not being honored. [852a60a]\n  * Watt-32 build support had been broken for some time. [PR #781]\n  * Distribute `ares_dns_rec_type_tostr` manpage. [PR #778]\n- c-ares 1.30.0:\n  * Basic support for SIG RR record (RFC 2931 / RFC 2535) [PR #773]\n  * Validation that DNS strings can only consist of printable ascii characters otherwise will trigger a parse failure.\n    [75de16c] and [40fb125]\n  * `QueryCache`: Fix issue where purging on server changes wasn't working. [a6c8fe6]\n- c-ares 1.29.0:\n  * When using `ARES_OPT_EVENT_THREAD`, automatically reload system configuration when network conditions change.\n    [PR #759]\n  * Apple: reimplement DNS configuration reading to more accurately pull DNS settings. [PR #750]\n  * Add observability into DNS server health via a server state callback, invoked whenever a query finishes. [PR #744]\n  * Add server failover retry behavior, where failed servers are retried with small probability after a minimum delay.\n    [PR #731]\n  * Mark `ares_channel_t *` as `const` in more places in the public API. [PR #758]\n  * Due to a logic flaw, dns name compression writing was not properly implemented which would result in the name prefix\n    not being written for a partial match. This could cause issues in various record types such as `MX` records when\n    using the deprecated API. Regression introduced in 1.28.0. [Issue #757]\n  * Revert OpenBSD `SOCK_DNS` flag, it doesn't do what the docs say it does and causes c-ares to become non-functional.\n    [PR #754]\n  * `ares_getnameinfo()`: loosen validation on `salen` parameter. [Issue #752]\n  * `cmake`: Android requires C99. [PR #748]\n  * `ares_queue_wait_empty()` does not honor `timeout_ms \u003e= 0`. [Issue #742]\n- c-ares 1.28.1:\n  * Emit warnings when deprecated c-ares functions are used. This can be disabled by passing a compiler definition of\n   `CARES_NO_DEPRECATED`. [PR #732]\n  * Add function `ares_search_dnsrec()` to search for records using the new DNS record data structures. [PR #719]\n  * Rework internals to pass around `ares_dns_record_t` instead of binary data, this introduces new public functions of\n    `ares_query_dnsrec()` and `ares_send_dnsrec()`. [PR #730]\n  * tests: when performing simulated queries, reduce timeouts to make tests run faster.\n  * Replace configuration file parsers with memory-safe parser. [PR #725]\n  * Remove `acountry` completely, the manpage might still get installed otherwise. [Issue #718]\n  * CMake: don't overwrite global required libraries/definitions/includes which could cause build errors for projects\n    chain building c-ares. [Issue #729]\n  * On some platforms, `netinet6/in6.h` is not included by `netinet/in.h` and needs to be included separately. [PR #728]\n  * Fix a potential memory leak in `ares_init()`. [Issue #724]\n  * Some platforms don't have the `isascii()` function. Implement as a macro. [PR #721]\n  * CMake: Fix chain building if `CMAKE` runtime paths not set.\n  * NDots configuration should allow a value of zero. [PR #735]\n","status":"published","published":"2026-08-28T11:28:12Z","modified":"2026-09-10T18:23:13.347908946Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23414-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdate to c-ares 1.34.8.\n\n- CVE-2025-31498: use-after-free in `read_answers()` when `process_answer()` may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- c-ares 1.34.8:\n  * For details, see https://c-ares.org/changelog.html.\n- c-ares 1.34.6:\n  * Ignore Windows IDN Search Domains until proper IDN support is added.\n  * Various bug fixes.\n- c-ares 1.34.4:\n  * Changes:\n    -  QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938\n  * Bugfixes:\n    - Empty TXT records were not being preserved. PR #922\n    - `docs`: update deprecation notices for `ares_create_query()` and `ares_mkquery()`. PR #910\n    - `license`: some files weren't properly updated. PR #920\n    - Fix `bind` local device regression from 1.34.0. PR #929, PR #931, PR #935\n    - `CMake`: set policy version to prevent deprecation warnings. PR #932\n    - `CMake`: shared and static library names should be the same on unix platforms like `autotools` uses. PR #933\n    - Update to latest `autoconf` archive macros for enhanced system compatibility. PR #936\n- c-ares 1.34.3:\n  * Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906\n  * Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911\n  * TSAN warns on missing lock, but lock isn't actually necessary. PR #915\n  * `ares_getaddrinfo(`) for `AF_UNSPEC` should retry IPv4 if only IPv6 is received. 765d558\n  * `ares_send()` shouldn't return `ARES_EBADRESP`, its `ARES_EBADQUERY`. 91519e7\n  * Fix typos in man pages. PR #905\n- c-ares 1.34.2:\n  * Features:\n    - `adig`: read arguments from `adigrc`. [PR #856]\n    - Add new pending write callback optimization via `ares_set_pending_write_cb`. [PR #857]\n    - New function `ares_process_fds()`. [PR #875]\n    - Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]\n    - `adig`: rework command line arguments to mimic `dig` from `bind`. [PR #890]\n    - Add new method for overriding network functions `ares_set_socket_function_ex()` to properly support all new\n      functionality. [PR #894]\n    - Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]\n    - `ares_socket`: set `IP_BIND_ADDRESS_NO_PORT` on `ares_set_local_ip*` tcp sockets [PR #887]\n    - URI parser/writer for `ares_set_servers_csv()`/`ares_get_servers_csv()`. [PR #882]\n    - Connection handling modularization. [PR #857], [PR #876]\n    - Expose library/utility functions to tools. [PR #860]\n    - Remove `ares__` prefix, just use `ares_` for internal functions. [PR #872]\n    - fix: potential `WIN32_LEAN_AND_MEAN` redefinition. [PR #869]\n    - Fix `googletest` v1.15 compatibility. [PR #874]\n    - Fix `pkgconfig` thread dependencies. [PR #884]\n- c-ares 1.33.0:\n  * Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]\n  * Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]\n  * Reorganize source tree. [PR #822]\n  * Refactoring of connection handling to prevent code duplication. [PR #839]\n  * New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]\n  * `ares_destroy()` race condition during shutdown due to missing lock. [PR #831]\n- c-ares in 1.32:\n  * Add support for DNS `0x20` to help prevent cache poisoning attacks, enabled by specifying `ARES_FLAG_DNS0x20`.\n    Disabled by default. [PR #800]\n  * Rework query timeout logic to automatically adjust timeouts based on network conditions. The timeout specified now\n    is only used as a hint until there is enough history to calculate a more valid timeout. [PR #794]\n  * DNS RR `TXT` strings should not be automatically concatenated as there are use cases outside of RFC 7208. In order\n    to maintain ABI compliance, the ability to retrieve `TXT` strings concatenated is retained as well as a new API to\n    retrieve the individual strings. This restores behavior from c-ares 1.20.0. [PR #801]\n  * Clean up header inclusion logic to make hacking on code easier. [PR #797]\n  * GCC/Clang: Enable even more strict warnings to catch more coding flaws. [253bdee]\n  * Tests: Fix thread race condition in test cases for `EventThread`. [PR #803]\n  * Thread Saftey: `ares_timeout()` was missing lock. [74a64e4]\n- c-ares 1.31.0:\n  * Enable Query Cache by default. [PR #786]\n  * Enhance Windows DNS configuration change detection to also detect manual DNS configuration changes. [PR #785]\n  * Various legacy MacOS Build fixes. [Issue #782]\n  * Ndots value of zero in `resolv.conf` was not being honored. [852a60a]\n  * Watt-32 build support had been broken for some time. [PR #781]\n  * Distribute `ares_dns_rec_type_tostr` manpage. [PR #778]\n- c-ares 1.30.0:\n  * Basic support for SIG RR record (RFC 2931 / RFC 2535) [PR #773]\n  * Validation that DNS strings can only consist of printable ascii characters otherwise will trigger a parse failure.\n    [75de16c] and [40fb125]\n  * `QueryCache`: Fix issue where purging on server changes wasn't working. [a6c8fe6]\n- c-ares 1.29.0:\n  * When using `ARES_OPT_EVENT_THREAD`, automatically reload system configuration when network conditions change.\n    [PR #759]\n  * Apple: reimplement DNS configuration reading to more accurately pull DNS settings. [PR #750]\n  * Add observability into DNS server health via a server state callback, invoked whenever a query finishes. [PR #744]\n  * Add server failover retry behavior, where failed servers are retried with small probability after a minimum delay.\n    [PR #731]\n  * Mark `ares_channel_t *` as `const` in more places in the public API. [PR #758]\n  * Due to a logic flaw, dns name compression writing was not properly implemented which would result in the name prefix\n    not being written for a partial match. This could cause issues in various record types such as `MX` records when\n    using the deprecated API. Regression introduced in 1.28.0. [Issue #757]\n  * Revert OpenBSD `SOCK_DNS` flag, it doesn't do what the docs say it does and causes c-ares to become non-functional.\n    [PR #754]\n  * `ares_getnameinfo()`: loosen validation on `salen` parameter. [Issue #752]\n  * `cmake`: Android requires C99. [PR #748]\n  * `ares_queue_wait_empty()` does not honor `timeout_ms \u003e= 0`. [Issue #742]\n- c-ares 1.28.1:\n  * Emit warnings when deprecated c-ares functions are used. This can be disabled by passing a compiler definition of\n   `CARES_NO_DEPRECATED`. [PR #732]\n  * Add function `ares_search_dnsrec()` to search for records using the new DNS record data structures. [PR #719]\n  * Rework internals to pass around `ares_dns_record_t` instead of binary data, this introduces new public functions of\n    `ares_query_dnsrec()` and `ares_send_dnsrec()`. [PR #730]\n  * tests: when performing simulated queries, reduce timeouts to make tests run faster.\n  * Replace configuration file parsers with memory-safe parser. [PR #725]\n  * Remove `acountry` completely, the manpage might still get installed otherwise. [Issue #718]\n  * CMake: don't overwrite global required libraries/definitions/includes which could cause build errors for projects\n    chain building c-ares. [Issue #729]\n  * On some platforms, `netinet6/in6.h` is not included by `netinet/in.h` and needs to be included separately. [PR #728]\n  * Fix a potential memory leak in `ares_init()`. [Issue #724]\n  * Some platforms don't have the `isascii()` function. Implement as a macro. [PR #721]\n  * CMake: Fix chain building if `CMAKE` runtime paths not set.\n  * NDots configuration should allow a value of zero. [PR #735]\n","status":"published","published":"2026-08-31T19:41:34Z","modified":"2026-09-14T18:23:09.022091473Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23597-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdat to c-ares 1.36.8.\n\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- For details, see https://c-ares.org/changelog.html.\n","status":"published","published":"2026-09-01T15:51:00Z","modified":"2026-09-29T18:23:19.002435176Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3872-1","title":"Security update for libcares2","description":"This update for libcares2 fixes the following issues:\n\n- CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via\n  ares_getaddrinfo() over TCP (bsc#1270416).\n- CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n","status":"published","published":"2026-08-28T17:57:11Z","modified":"2026-09-10T18:23:16.250701363Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4021-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\n- CVE-2024-25629: out of bounds read in ares__read_line() (bsc#1220279).\n- CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via\n  ares_getaddrinfo() over TCP (bsc#1270416).\n- CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: Memory-amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- updated to 1.36.8.\n","status":"published","published":"2026-09-07T07:42:20Z","modified":"2026-09-13T18:23:16.109232489Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8951-1","title":"c-ares vulnerabilities","description":"It was discovered that c-ares incorrectly parsed certain SOA replies. A\nremote attacker could possibly use this issue to cause c-ares to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04 LTS\nand Ubuntu 18.04 LTS. (CVE-2020-22217)\n\nIt was discovered that c-ares incorrectly handled certain sortlist strings.\nA remote attacker could possibly use this issue to cause c-ares to crash,\nresulting in a denial of service, or execute arbitrary code. This issue\nonly affected Ubuntu 16.04 LTS. (CVE-2022-4904)\n\nIt was discovered that c-ares did not properly limit DNS compression\npointer hops or assembled name lengths when parsing DNS names. A remote\nattacker could possibly use this issue to cause c-ares to use excessive\nresources, resulting in a denial of service. (CVE-2026-69184)\n\nIt was discovered that c-ares did not properly validate record count fields\nbefore allocating memory when parsing DNS responses. A remote attacker\ncould possibly use this issue to cause c-ares to use excessive resources,\nresulting in a denial of service. This issue only affected Ubuntu 24.04 LTS\nand Ubuntu 26.04 LTS. (CVE-2026-69186)","status":"published","published":"2026-10-21T18:20:42Z","modified":"2026-10-22T04:42:58.035678055Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}