CVE-2026-69186
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In c-ares prior to 1.34.7, ares_dns_parse() trusted attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming the DNS response contained enough bytes. A malicious DNS response could cause disproportionate heap allocation for a tiny message, degrading or denying name resolution.
Risk Assessment
Repeated malicious DNS responses can exhaust memory and disrupt name resolution in applications using c-ares, causing denial of service.
Recommendation
Upgrade c-ares to version 1.34.7 or later, which validates record counts before memory allocation.
Other vulnerabilities in c-ares
See all- CVE-2017-1000381High
The `ares_parse_naptr_reply()` function in the c-ares library may read memory outside of the given input buffer if the passed DNS response packet is crafted in a specific way.
- CVE-2016-5180Critical
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a hostname with an escaped trailing dot.
- CVE-2026-69184High
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size.
- CVE-2026-33630High
c-ares is an asynchronous resolver library. From version 1.32.3 until 1.34.7, a use-after-free / double-free vulnerability exists in query-completion handling. The same flaw is present at multiple points in the resend/finish path.
Original NVD description (English source)
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS