{"id":"CVE-2026-69186","aliases":["AZL-103304","AZL-103454","BELL-CVE-2026-69186","DEBIAN-CVE-2026-69186","EUVD-2026-83212","GHSA-jv8r-gqr9-68wj","MGASA-2026-0343","RHSA-2026:40574","SUSE-SU-2026:23364-1","SUSE-SU-2026:23414-1","SUSE-SU-2026:23597-1","SUSE-SU-2026:4021-1","UBUNTU-CVE-2026-69186","USN-8951-1","openSUSE-SU-2026:11593-1","openSUSE-SU-2026:21721-1"],"status":"published","title":"c-ares: Memory-amplification denial of service via unvalidated DNS header record counts","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00466,"percentile":0.40805,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-08-15T06:06:33.170313Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"c-ares","fixed_in":["1.34.8-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"c-ares","fixed_in":["1.34.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"c-ares","fixed_in":["1.27.0-1.0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"c-ares","fixed_in":["1.34.6-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"fluent-bit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.10-8"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.5-r0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-r0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.5-r0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-r0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34.5-1","1.34.5-1+deb13u1","1.34.6-1","1.34.7-1","1.34.8-1"]},{"source":"osv","ecosystem":"Debian:14","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.7-1"}]}],"versions":["1.34.5-1","1.34.6-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.8-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"c-ares-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.8-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-slfo.1.1_1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-1.0ubuntu1.1"}]}],"versions":["1.19.1-3","1.20.1-1","1.26.0-1","1.27.0-1","1.27.0-1.0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.6-1ubuntu0.2"}]}],"versions":["1.34.5-1","1.34.6-1","1.34.6-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-3ubuntu0.2+esm4"}]}],"versions":["1.10.0-2","1.10.0-3","1.10.0-3ubuntu0.1","1.10.0-3ubuntu0.2","1.10.0-3ubuntu0.2+esm1","1.10.0-3ubuntu0.2+esm2","1.10.0-3ubuntu0.2+esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1ubuntu0.2+esm3"}]}],"versions":["1.13.0-2","1.13.0-3","1.14.0-1","1.14.0-1ubuntu0.1","1.14.0-1ubuntu0.2","1.14.0-1ubuntu0.2+esm1","1.14.0-1ubuntu0.2+esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-1ubuntu0.5+esm1"}]}],"versions":["1.15.0-1build1","1.15.0-1ubuntu0.1","1.15.0-1ubuntu0.2","1.15.0-1ubuntu0.3","1.15.0-1ubuntu0.4","1.15.0-1ubuntu0.5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu0.22.04.4"}]}],"versions":["1.17.1-1ubuntu1","1.18.1-1","1.18.1-1build1","1.18.1-1ubuntu0.22.04.1","1.18.1-1ubuntu0.22.04.2","1.18.1-1ubuntu0.22.04.3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-1.0ubuntu1.1"}]}],"versions":["1.19.1-3","1.20.1-1","1.26.0-1","1.27.0-1","1.27.0-1.0ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.6-1ubuntu0.2"}]}],"versions":["1.34.5-1","1.34.6-1","1.34.6-1ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-160000.1.1"}]}],"bundled":3}],"products":[{"vendor":"c-ares","product":"c-ares"}],"references":[{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj","tags":["x_refsource_CONFIRM","exploit","advisory","article","report"]},{"url":"https://github.com/c-ares/c-ares/pull/1134","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/c-ares/c-ares/commit/e47c203f91cd8b749c8736bc18d75a31ffdec8f4","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/c-ares/c-ares/commit/eaded4cb200b2a5f8d73f11021ff7c8d6968aaab","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/c-ares/c-ares/releases/tag/v1.34.7","tags":["x_refsource_MISC","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69186","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-69186","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69186.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-69186","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0343.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35847","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/06/8","tags":["web","report"]},{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76","tags":["advisory","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RP4OX63ZTYCCB4UK6HI4BFEPQEPSNLOJ/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40574","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69186","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69184","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40574.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538396","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69184","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/commit/5c8341ba6ff3a8e4e4dfd616f8ed0418838b8b7b","tags":["article"]},{"url":"https://github.com/c-ares/c-ares/commit/f1288bbc70e9a1e0a77134c2382157e52d326aea","tags":["article"]},{"url":"https://github.com/c-ares/c-ares/pull/1164","tags":["article"]},{"url":"https://github.com/c-ares/c-ares/pull/1210","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538212","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69186","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623364-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240955","tags":["report"]},{"url":"https://bugzilla.suse.com/1254738","tags":["report"]},{"url":"https://bugzilla.suse.com/1270416","tags":["report"]},{"url":"https://bugzilla.suse.com/1276290","tags":["report"]},{"url":"https://bugzilla.suse.com/1276291","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623414-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623597-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264021-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220279","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25629","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-69186","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8951-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-22217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4904","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-69184","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-69186","title":"c-ares: Memory-amplification denial of service via unvalidated DNS header record counts","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T17:25:42.44Z","modified":"2026-09-18T19:51:33.881Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:50:27.582139Z"}],"euvd":[{"id":"EUVD-2026-83212","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T17:25:42Z","modified":"2026-09-18T19:51:33Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T17:28:07.574446Z"}],"nvd":[{"id":"CVE-2026-69186","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T18:17:11.637Z","modified":"2026-09-23T18:12:04.247Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"BELL-CVE-2026-69186","status":"published","published":"2026-08-15T06:06:33.170313Z","modified":"2026-09-20T07:15:06.766653469Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:25.50888Z"},{"id":"CVE-2026-69186","title":"c-ares: Memory-amplification denial of service via unvalidated DNS header record counts","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T17:25:42.44Z","modified":"2026-10-28T11:01:24.257504952Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"DEBIAN-CVE-2026-69186","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T18:17:11.637Z","modified":"2026-09-24T08:47:25.462008761Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"RHSA-2026:40574","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-26T10:08:26Z","modified":"2026-10-17T10:13:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"UBUNTU-CVE-2026-69186","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T18:17:00Z","modified":"2026-10-21T23:01:00.484153721Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"AZL-103304","title":"CVE-2026-69186 affecting package c-ares for versions less than 1.34.8-1","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T18:17:11Z","modified":"2026-11-02T14:15:37.435017629Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103454","title":"CVE-2026-69186 affecting package fluent-bit 3.1.10-8","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","status":"published","published":"2026-09-18T18:17:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.528763Z"},{"id":"MGASA-2026-0343","title":"Updated c-ares packages fix security vulnerabilities","description":"Use-after-free / double-free in c-ares query-completion handling,\nremotely triggerable via ares_getaddrinfo() over TCP. (CVE-2026-33630)\nCPU-exhaustion denial of service via unbounded DNS name compression\npointer chains. (CVE-2026-69184)\nMemory-amplification denial of service via unvalidated DNS header record\ncounts. (CVE-2026-69186)\n","status":"published","published":"2026-08-31T16:22:02Z","modified":"2026-08-31T16:30:04.403545003Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11593-1","title":"c-ares-devel-1.34.8-1.1 on GA media","description":"These are all security issues fixed in the c-ares-devel-1.34.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-25T00:00:00Z","modified":"2026-08-26T10:15:03.389391117Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21721-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdat to c-ares 1.36.8.\n\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- For details, see https://c-ares.org/changelog.html.\n","status":"published","published":"2026-09-01T15:48:33Z","modified":"2026-09-02T18:00:03.313428309Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23364-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdate to c-ares 1.34.8.\n\n- CVE-2025-31498: use-after-free in `read_answers()` when `process_answer()` may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- c-ares 1.34.8:\n  * For details, see https://c-ares.org/changelog.html.\n- c-ares 1.34.6:\n  * Ignore Windows IDN Search Domains until proper IDN support is added.\n  * Various bug fixes.\n- c-ares 1.34.4:\n  * Changes:\n    -  QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938\n  * Bugfixes:\n    - Empty TXT records were not being preserved. PR #922\n    - `docs`: update deprecation notices for `ares_create_query()` and `ares_mkquery()`. PR #910\n    - `license`: some files weren't properly updated. PR #920\n    - Fix `bind` local device regression from 1.34.0. PR #929, PR #931, PR #935\n    - `CMake`: set policy version to prevent deprecation warnings. PR #932\n    - `CMake`: shared and static library names should be the same on unix platforms like `autotools` uses. PR #933\n    - Update to latest `autoconf` archive macros for enhanced system compatibility. PR #936\n- c-ares 1.34.3:\n  * Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906\n  * Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911\n  * TSAN warns on missing lock, but lock isn't actually necessary. PR #915\n  * `ares_getaddrinfo(`) for `AF_UNSPEC` should retry IPv4 if only IPv6 is received. 765d558\n  * `ares_send()` shouldn't return `ARES_EBADRESP`, its `ARES_EBADQUERY`. 91519e7\n  * Fix typos in man pages. PR #905\n- c-ares 1.34.2:\n  * Features:\n    - `adig`: read arguments from `adigrc`. [PR #856]\n    - Add new pending write callback optimization via `ares_set_pending_write_cb`. [PR #857]\n    - New function `ares_process_fds()`. [PR #875]\n    - Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]\n    - `adig`: rework command line arguments to mimic `dig` from `bind`. [PR #890]\n    - Add new method for overriding network functions `ares_set_socket_function_ex()` to properly support all new\n      functionality. [PR #894]\n    - Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]\n    - `ares_socket`: set `IP_BIND_ADDRESS_NO_PORT` on `ares_set_local_ip*` tcp sockets [PR #887]\n    - URI parser/writer for `ares_set_servers_csv()`/`ares_get_servers_csv()`. [PR #882]\n    - Connection handling modularization. [PR #857], [PR #876]\n    - Expose library/utility functions to tools. [PR #860]\n    - Remove `ares__` prefix, just use `ares_` for internal functions. [PR #872]\n    - fix: potential `WIN32_LEAN_AND_MEAN` redefinition. [PR #869]\n    - Fix `googletest` v1.15 compatibility. [PR #874]\n    - Fix `pkgconfig` thread dependencies. [PR #884]\n- c-ares 1.33.0:\n  * Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]\n  * Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]\n  * Reorganize source tree. [PR #822]\n  * Refactoring of connection handling to prevent code duplication. [PR #839]\n  * New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]\n  * `ares_destroy()` race condition during shutdown due to missing lock. [PR #831]\n- c-ares in 1.32:\n  * Add support for DNS `0x20` to help prevent cache poisoning attacks, enabled by specifying `ARES_FLAG_DNS0x20`.\n    Disabled by default. [PR #800]\n  * Rework query timeout logic to automatically adjust timeouts based on network conditions. The timeout specified now\n    is only used as a hint until there is enough history to calculate a more valid timeout. [PR #794]\n  * DNS RR `TXT` strings should not be automatically concatenated as there are use cases outside of RFC 7208. In order\n    to maintain ABI compliance, the ability to retrieve `TXT` strings concatenated is retained as well as a new API to\n    retrieve the individual strings. This restores behavior from c-ares 1.20.0. [PR #801]\n  * Clean up header inclusion logic to make hacking on code easier. [PR #797]\n  * GCC/Clang: Enable even more strict warnings to catch more coding flaws. [253bdee]\n  * Tests: Fix thread race condition in test cases for `EventThread`. [PR #803]\n  * Thread Saftey: `ares_timeout()` was missing lock. [74a64e4]\n- c-ares 1.31.0:\n  * Enable Query Cache by default. [PR #786]\n  * Enhance Windows DNS configuration change detection to also detect manual DNS configuration changes. [PR #785]\n  * Various legacy MacOS Build fixes. [Issue #782]\n  * Ndots value of zero in `resolv.conf` was not being honored. [852a60a]\n  * Watt-32 build support had been broken for some time. [PR #781]\n  * Distribute `ares_dns_rec_type_tostr` manpage. [PR #778]\n- c-ares 1.30.0:\n  * Basic support for SIG RR record (RFC 2931 / RFC 2535) [PR #773]\n  * Validation that DNS strings can only consist of printable ascii characters otherwise will trigger a parse failure.\n    [75de16c] and [40fb125]\n  * `QueryCache`: Fix issue where purging on server changes wasn't working. [a6c8fe6]\n- c-ares 1.29.0:\n  * When using `ARES_OPT_EVENT_THREAD`, automatically reload system configuration when network conditions change.\n    [PR #759]\n  * Apple: reimplement DNS configuration reading to more accurately pull DNS settings. [PR #750]\n  * Add observability into DNS server health via a server state callback, invoked whenever a query finishes. [PR #744]\n  * Add server failover retry behavior, where failed servers are retried with small probability after a minimum delay.\n    [PR #731]\n  * Mark `ares_channel_t *` as `const` in more places in the public API. [PR #758]\n  * Due to a logic flaw, dns name compression writing was not properly implemented which would result in the name prefix\n    not being written for a partial match. This could cause issues in various record types such as `MX` records when\n    using the deprecated API. Regression introduced in 1.28.0. [Issue #757]\n  * Revert OpenBSD `SOCK_DNS` flag, it doesn't do what the docs say it does and causes c-ares to become non-functional.\n    [PR #754]\n  * `ares_getnameinfo()`: loosen validation on `salen` parameter. [Issue #752]\n  * `cmake`: Android requires C99. [PR #748]\n  * `ares_queue_wait_empty()` does not honor `timeout_ms \u003e= 0`. [Issue #742]\n- c-ares 1.28.1:\n  * Emit warnings when deprecated c-ares functions are used. This can be disabled by passing a compiler definition of\n   `CARES_NO_DEPRECATED`. [PR #732]\n  * Add function `ares_search_dnsrec()` to search for records using the new DNS record data structures. [PR #719]\n  * Rework internals to pass around `ares_dns_record_t` instead of binary data, this introduces new public functions of\n    `ares_query_dnsrec()` and `ares_send_dnsrec()`. [PR #730]\n  * tests: when performing simulated queries, reduce timeouts to make tests run faster.\n  * Replace configuration file parsers with memory-safe parser. [PR #725]\n  * Remove `acountry` completely, the manpage might still get installed otherwise. [Issue #718]\n  * CMake: don't overwrite global required libraries/definitions/includes which could cause build errors for projects\n    chain building c-ares. [Issue #729]\n  * On some platforms, `netinet6/in6.h` is not included by `netinet/in.h` and needs to be included separately. [PR #728]\n  * Fix a potential memory leak in `ares_init()`. [Issue #724]\n  * Some platforms don't have the `isascii()` function. Implement as a macro. [PR #721]\n  * CMake: Fix chain building if `CMAKE` runtime paths not set.\n  * NDots configuration should allow a value of zero. [PR #735]\n","status":"published","published":"2026-08-28T11:28:12Z","modified":"2026-09-10T18:23:13.347908946Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23414-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdate to c-ares 1.34.8.\n\n- CVE-2025-31498: use-after-free in `read_answers()` when `process_answer()` may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- c-ares 1.34.8:\n  * For details, see https://c-ares.org/changelog.html.\n- c-ares 1.34.6:\n  * Ignore Windows IDN Search Domains until proper IDN support is added.\n  * Various bug fixes.\n- c-ares 1.34.4:\n  * Changes:\n    -  QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938\n  * Bugfixes:\n    - Empty TXT records were not being preserved. PR #922\n    - `docs`: update deprecation notices for `ares_create_query()` and `ares_mkquery()`. PR #910\n    - `license`: some files weren't properly updated. PR #920\n    - Fix `bind` local device regression from 1.34.0. PR #929, PR #931, PR #935\n    - `CMake`: set policy version to prevent deprecation warnings. PR #932\n    - `CMake`: shared and static library names should be the same on unix platforms like `autotools` uses. PR #933\n    - Update to latest `autoconf` archive macros for enhanced system compatibility. PR #936\n- c-ares 1.34.3:\n  * Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906\n  * Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911\n  * TSAN warns on missing lock, but lock isn't actually necessary. PR #915\n  * `ares_getaddrinfo(`) for `AF_UNSPEC` should retry IPv4 if only IPv6 is received. 765d558\n  * `ares_send()` shouldn't return `ARES_EBADRESP`, its `ARES_EBADQUERY`. 91519e7\n  * Fix typos in man pages. PR #905\n- c-ares 1.34.2:\n  * Features:\n    - `adig`: read arguments from `adigrc`. [PR #856]\n    - Add new pending write callback optimization via `ares_set_pending_write_cb`. [PR #857]\n    - New function `ares_process_fds()`. [PR #875]\n    - Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]\n    - `adig`: rework command line arguments to mimic `dig` from `bind`. [PR #890]\n    - Add new method for overriding network functions `ares_set_socket_function_ex()` to properly support all new\n      functionality. [PR #894]\n    - Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]\n    - `ares_socket`: set `IP_BIND_ADDRESS_NO_PORT` on `ares_set_local_ip*` tcp sockets [PR #887]\n    - URI parser/writer for `ares_set_servers_csv()`/`ares_get_servers_csv()`. [PR #882]\n    - Connection handling modularization. [PR #857], [PR #876]\n    - Expose library/utility functions to tools. [PR #860]\n    - Remove `ares__` prefix, just use `ares_` for internal functions. [PR #872]\n    - fix: potential `WIN32_LEAN_AND_MEAN` redefinition. [PR #869]\n    - Fix `googletest` v1.15 compatibility. [PR #874]\n    - Fix `pkgconfig` thread dependencies. [PR #884]\n- c-ares 1.33.0:\n  * Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]\n  * Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]\n  * Reorganize source tree. [PR #822]\n  * Refactoring of connection handling to prevent code duplication. [PR #839]\n  * New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]\n  * `ares_destroy()` race condition during shutdown due to missing lock. [PR #831]\n- c-ares in 1.32:\n  * Add support for DNS `0x20` to help prevent cache poisoning attacks, enabled by specifying `ARES_FLAG_DNS0x20`.\n    Disabled by default. [PR #800]\n  * Rework query timeout logic to automatically adjust timeouts based on network conditions. The timeout specified now\n    is only used as a hint until there is enough history to calculate a more valid timeout. [PR #794]\n  * DNS RR `TXT` strings should not be automatically concatenated as there are use cases outside of RFC 7208. In order\n    to maintain ABI compliance, the ability to retrieve `TXT` strings concatenated is retained as well as a new API to\n    retrieve the individual strings. This restores behavior from c-ares 1.20.0. [PR #801]\n  * Clean up header inclusion logic to make hacking on code easier. [PR #797]\n  * GCC/Clang: Enable even more strict warnings to catch more coding flaws. [253bdee]\n  * Tests: Fix thread race condition in test cases for `EventThread`. [PR #803]\n  * Thread Saftey: `ares_timeout()` was missing lock. [74a64e4]\n- c-ares 1.31.0:\n  * Enable Query Cache by default. [PR #786]\n  * Enhance Windows DNS configuration change detection to also detect manual DNS configuration changes. [PR #785]\n  * Various legacy MacOS Build fixes. [Issue #782]\n  * Ndots value of zero in `resolv.conf` was not being honored. [852a60a]\n  * Watt-32 build support had been broken for some time. [PR #781]\n  * Distribute `ares_dns_rec_type_tostr` manpage. [PR #778]\n- c-ares 1.30.0:\n  * Basic support for SIG RR record (RFC 2931 / RFC 2535) [PR #773]\n  * Validation that DNS strings can only consist of printable ascii characters otherwise will trigger a parse failure.\n    [75de16c] and [40fb125]\n  * `QueryCache`: Fix issue where purging on server changes wasn't working. [a6c8fe6]\n- c-ares 1.29.0:\n  * When using `ARES_OPT_EVENT_THREAD`, automatically reload system configuration when network conditions change.\n    [PR #759]\n  * Apple: reimplement DNS configuration reading to more accurately pull DNS settings. [PR #750]\n  * Add observability into DNS server health via a server state callback, invoked whenever a query finishes. [PR #744]\n  * Add server failover retry behavior, where failed servers are retried with small probability after a minimum delay.\n    [PR #731]\n  * Mark `ares_channel_t *` as `const` in more places in the public API. [PR #758]\n  * Due to a logic flaw, dns name compression writing was not properly implemented which would result in the name prefix\n    not being written for a partial match. This could cause issues in various record types such as `MX` records when\n    using the deprecated API. Regression introduced in 1.28.0. [Issue #757]\n  * Revert OpenBSD `SOCK_DNS` flag, it doesn't do what the docs say it does and causes c-ares to become non-functional.\n    [PR #754]\n  * `ares_getnameinfo()`: loosen validation on `salen` parameter. [Issue #752]\n  * `cmake`: Android requires C99. [PR #748]\n  * `ares_queue_wait_empty()` does not honor `timeout_ms \u003e= 0`. [Issue #742]\n- c-ares 1.28.1:\n  * Emit warnings when deprecated c-ares functions are used. This can be disabled by passing a compiler definition of\n   `CARES_NO_DEPRECATED`. [PR #732]\n  * Add function `ares_search_dnsrec()` to search for records using the new DNS record data structures. [PR #719]\n  * Rework internals to pass around `ares_dns_record_t` instead of binary data, this introduces new public functions of\n    `ares_query_dnsrec()` and `ares_send_dnsrec()`. [PR #730]\n  * tests: when performing simulated queries, reduce timeouts to make tests run faster.\n  * Replace configuration file parsers with memory-safe parser. [PR #725]\n  * Remove `acountry` completely, the manpage might still get installed otherwise. [Issue #718]\n  * CMake: don't overwrite global required libraries/definitions/includes which could cause build errors for projects\n    chain building c-ares. [Issue #729]\n  * On some platforms, `netinet6/in6.h` is not included by `netinet/in.h` and needs to be included separately. [PR #728]\n  * Fix a potential memory leak in `ares_init()`. [Issue #724]\n  * Some platforms don't have the `isascii()` function. Implement as a macro. [PR #721]\n  * CMake: Fix chain building if `CMAKE` runtime paths not set.\n  * NDots configuration should allow a value of zero. [PR #735]\n","status":"published","published":"2026-08-31T19:41:34Z","modified":"2026-09-14T18:23:09.022091473Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23597-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdat to c-ares 1.36.8.\n\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- For details, see https://c-ares.org/changelog.html.\n","status":"published","published":"2026-09-01T15:51:00Z","modified":"2026-09-29T18:23:19.002435176Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4021-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\n- CVE-2024-25629: out of bounds read in ares__read_line() (bsc#1220279).\n- CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via\n  ares_getaddrinfo() over TCP (bsc#1270416).\n- CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: Memory-amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- updated to 1.36.8.\n","status":"published","published":"2026-09-07T07:42:20Z","modified":"2026-09-13T18:23:16.109232489Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8951-1","title":"c-ares vulnerabilities","description":"It was discovered that c-ares incorrectly parsed certain SOA replies. A\nremote attacker could possibly use this issue to cause c-ares to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04 LTS\nand Ubuntu 18.04 LTS. (CVE-2020-22217)\n\nIt was discovered that c-ares incorrectly handled certain sortlist strings.\nA remote attacker could possibly use this issue to cause c-ares to crash,\nresulting in a denial of service, or execute arbitrary code. This issue\nonly affected Ubuntu 16.04 LTS. (CVE-2022-4904)\n\nIt was discovered that c-ares did not properly limit DNS compression\npointer hops or assembled name lengths when parsing DNS names. A remote\nattacker could possibly use this issue to cause c-ares to use excessive\nresources, resulting in a denial of service. (CVE-2026-69184)\n\nIt was discovered that c-ares did not properly validate record count fields\nbefore allocating memory when parsing DNS responses. A remote attacker\ncould possibly use this issue to cause c-ares to use excessive resources,\nresulting in a denial of service. This issue only affected Ubuntu 24.04 LTS\nand Ubuntu 26.04 LTS. (CVE-2026-69186)","status":"published","published":"2026-10-21T18:20:42Z","modified":"2026-10-22T04:42:58.035678055Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}