CVE-2026-69184
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size.
Risk Assessment
A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, leading to denial of service. It does not cause memory corruption or information disclosure.
Recommendation
Update c-ares to version 1.34.7 or later. Monitor resolver behavior for unusual delays.
Other vulnerabilities in c-ares
See all- CVE-2017-1000381High
The `ares_parse_naptr_reply()` function in the c-ares library may read memory outside of the given input buffer if the passed DNS response packet is crafted in a specific way.
- CVE-2016-5180Critical
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a hostname with an escaped trailing dot.
- CVE-2026-69186Medium
In c-ares prior to 1.34.7, ares_dns_parse() trusted attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming the DNS response contained enough bytes. A malicious DNS response could cause disproportionate heap allocation for a tiny message, degrading or denying name resolution.
- CVE-2026-33630High
c-ares is an asynchronous resolver library. From version 1.32.3 until 1.34.7, a use-after-free / double-free vulnerability exists in query-completion handling. The same flaw is present at multiple points in the resend/finish path.
Original NVD description (English source)
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS