Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

c-ares library can be stalled by crafted DNS response

CVE-2026-69184 · published 1 month ago
Summary

The c-ares DNS resolver library (versions before 1.34.7) can be forced to waste CPU time when a malicious DNS server sends specially crafted responses. This can pause DNS lookups, affecting any application that relies on c-ares for name resolution. Update to version 1.34.7 or later to stop the problem.

What to do
  • Update bellsoft c-ares to version 1.34.8-r0.
  • Update debian c-ares to version 1.34.7-1.
  • Update c-ares to version 1.34.8-r0.
  • Update c-ares to version 1.33.1-r00074.
  • Update rootio-c-ares to version 1.33.1-r00074.
  • Update canonical c-ares to version 1.10.0-3ubuntu0.2+esm4.
  • Update canonical c-ares to version 1.14.0-1ubuntu0.2+esm3.
  • Update canonical c-ares to version 1.15.0-1ubuntu0.5+esm1.
  • Update canonical c-ares to version 1.18.1-1ubuntu0.22.04.4.
  • Update canonical c-ares to version 1.27.0-1.0ubuntu1.1.
  • Update canonical c-ares to version 1.34.6-1ubuntu0.2.
Affected software
Ecosystem VendorProductAffected versions
Alpaquita:25 bellsoft c-ares >= 1.34.5-r0, < 1.34.8-r0
Fix: upgrade to 1.34.8-r0
Alpaquita:stream bellsoft c-ares >= 1.20.1-r0, < 1.34.8-r0
Fix: upgrade to 1.34.8-r0
BellSoft Hardened Containers:25 bellsoft c-ares >= 1.34.5-r0, < 1.34.8-r0
Fix: upgrade to 1.34.8-r0
BellSoft Hardened Containers:stream bellsoft c-ares >= 1.20.1-r0, < 1.34.8-r0
Fix: upgrade to 1.34.8-r0
– c-ares c-ares < 1.34.7
Debian:13 debian c-ares All versions
Debian:14 debian c-ares < 1.34.7-1
Fix: upgrade to 1.34.7-1
BellSoft Hardened Containers:25 – c-ares >= 1.34.5-r0, < 1.34.8-r0
Fix: upgrade to 1.34.8-r0
BellSoft Hardened Containers:stream – c-ares >= 1.20.1-r0, < 1.34.8-r0
Fix: upgrade to 1.34.8-r0
Ubuntu:Pro:16.04:LTS canonical c-ares < 1.10.0-3ubuntu0.2+esm4
Fix: upgrade to 1.10.0-3ubuntu0.2+esm4
Root:Alpine:3.20 – c-ares < 1.33.1-r00074
Fix: upgrade to 1.33.1-r00074
Root:Alpine:3.20 – rootio-c-ares < 1.33.1-r00074
Fix: upgrade to 1.33.1-r00074
Ubuntu:Pro:18.04:LTS canonical c-ares < 1.14.0-1ubuntu0.2+esm3
Fix: upgrade to 1.14.0-1ubuntu0.2+esm3
Ubuntu:Pro:20.04:LTS canonical c-ares < 1.15.0-1ubuntu0.5+esm1
Fix: upgrade to 1.15.0-1ubuntu0.5+esm1
Ubuntu:22.04:LTS canonical c-ares < 1.18.1-1ubuntu0.22.04.4
Fix: upgrade to 1.18.1-1ubuntu0.22.04.4
Ubuntu:24.04:LTS canonical c-ares < 1.27.0-1.0ubuntu1.1
Fix: upgrade to 1.27.0-1.0ubuntu1.1
Ubuntu:26.04:LTS canonical c-ares < 1.34.6-1ubuntu0.2
Fix: upgrade to 1.34.6-1ubuntu0.2
Original advisory text
c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-407Inefficient Algorithmic Complexity
Timeline
Published18 Sep 2026
Updated4 Nov 2026
First seen20 Aug 2026
Sources
BELL-CVE-2026-69184 · OSV
CVE-2026-69184 · NVD
CVE-2026-69184 · MITRE
DEBIAN-CVE-2026-69184 · OSV
CVE-2026-69184 · OSV
GHSA-pjmc-gx33-gc76 · GHSA
UBUNTU-CVE-2026-69184 · OSV
ROOT-OS-ALPINE-320-CVE-2026-69184 · OSV
Track software like this
Free during beta