C ares: Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. (CVE-2026-69184)
c-ares versions prior to 1.34.7 contain a vulnerability in the ares_dns_name_parse() function where backward DNS compression pointers are enforced but the total pointer hops and assembled name length are not bounded. This allows a malicious DNS server to send a crafted response with a long descending pointer chain and many resource records referencing the chain, causing excessive decompression work that grows quadratically with message size. This can stall the single-threaded c-ares event loop and result in denial of DNS resolution without memory corruption or data leakage. The issue is fixed in version 1.34.7.
AI Analysis
Technical Summary
The asynchronous resolver library c-ares has a vulnerability in versions prior to 1.34.7 in the ares_dns_name_parse() function. While backward DNS compression pointers are enforced, there is no limit on the total number of pointer hops or the length of the assembled DNS name. An attacker controlling a DNS server can exploit this by sending a response with a long descending pointer chain and multiple resource records referencing this chain. This causes repeated decompression work that grows quadratically with the size of the DNS message, effectively stalling the single-threaded event loop of c-ares and denying DNS resolution. The vulnerability does not cause memory corruption or information disclosure. The issue is resolved in c-ares version 1.34.7.
Potential Impact
A malicious DNS server can cause denial of service by sending specially crafted DNS responses that stall the c-ares event loop, preventing DNS resolution. There is no impact on confidentiality or integrity, and no memory corruption occurs. The impact is limited to availability disruption of DNS resolution in affected versions.
Mitigation Recommendations
This vulnerability is fixed in c-ares version 1.34.7. Users should upgrade to version 1.34.7 or later to remediate this issue. No other mitigation is required.
C ares: Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. (CVE-2026-69184)
Description
c-ares versions prior to 1.34.7 contain a vulnerability in the ares_dns_name_parse() function where backward DNS compression pointers are enforced but the total pointer hops and assembled name length are not bounded. This allows a malicious DNS server to send a crafted response with a long descending pointer chain and many resource records referencing the chain, causing excessive decompression work that grows quadratically with message size. This can stall the single-threaded c-ares event loop and result in denial of DNS resolution without memory corruption or data leakage. The issue is fixed in version 1.34.7.
CVSS v3.1
Score 7.5high
Affected software
pkg:deb/ubuntu/c-ares?arch=source&distro=esm-infra/xenialpkg:deb/ubuntu/c-ares?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/c-ares?arch=source&distro=focalpkg:deb/ubuntu/c-ares?arch=source&distro=jammypkg:deb/ubuntu/c-ares?arch=source&distro=noblepkg:deb/ubuntu/c-ares?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The asynchronous resolver library c-ares has a vulnerability in versions prior to 1.34.7 in the ares_dns_name_parse() function. While backward DNS compression pointers are enforced, there is no limit on the total number of pointer hops or the length of the assembled DNS name. An attacker controlling a DNS server can exploit this by sending a response with a long descending pointer chain and multiple resource records referencing this chain. This causes repeated decompression work that grows quadratically with the size of the DNS message, effectively stalling the single-threaded event loop of c-ares and denying DNS resolution. The vulnerability does not cause memory corruption or information disclosure. The issue is resolved in c-ares version 1.34.7.
Potential Impact
A malicious DNS server can cause denial of service by sending specially crafted DNS responses that stall the c-ares event loop, preventing DNS resolution. There is no impact on confidentiality or integrity, and no memory corruption occurs. The impact is limited to availability disruption of DNS resolution in affected versions.
Mitigation Recommendations
This vulnerability is fixed in c-ares version 1.34.7. Users should upgrade to version 1.34.7 or later to remediate this issue. No other mitigation is required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-69184
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ab4be55f7a7c54106f0aa41
Added to database: 09/24/2026, 06:08:21 UTC
Last enriched: 09/24/2026, 06:46:46 UTC
Last updated: 09/24/2026, 06:46:46 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.