CVE catalog

CVE-2026-69184

c-ares vulnerabilities

[CVE catalog]

Severity
High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.48% · Oct 25, 2026

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianc-aressid1.34.9-1fixed
Debianc-aresforky1.34.8-1fixed
Debianc-arestrixie1.34.5-1+deb13u1vulnerable
Debianc-arestrixie-security1.34.5-1+deb13u1vulnerable
Debianc-aresbookworm1.18.1-3not affected
Ubuntuc-arespro1.15.0-1build1vulnerable
Ubuntuc-arespro1.15.0-1ubuntu0.1vulnerable
Ubuntuc-arespro1.15.0-1ubuntu0.2vulnerable
Ubuntuc-arespro1.15.0-1ubuntu0.3vulnerable
Ubuntuc-arespro1.15.0-1ubuntu0.4vulnerable
Ubuntuc-arespro1.15.0-1ubuntu0.5vulnerable
Ubuntuc-arespro1.15.0-1ubuntu0.5+esm1fixed
Ubuntuc-ares22.041.17.1-1ubuntu1vulnerable
Ubuntuc-ares22.041.18.1-1vulnerable
Ubuntuc-ares22.041.18.1-1build1vulnerable
Ubuntuc-ares22.041.18.1-1ubuntu0.22.04.1vulnerable
Ubuntuc-ares22.041.18.1-1ubuntu0.22.04.2vulnerable
Ubuntuc-ares22.041.18.1-1ubuntu0.22.04.3vulnerable
Ubuntuc-ares22.041.18.1-1ubuntu0.22.04.4fixed
Ubuntuc-ares24.041.19.1-3vulnerable
Ubuntuc-ares24.041.20.1-1vulnerable
Ubuntuc-ares24.041.26.0-1vulnerable
Ubuntuc-ares24.041.27.0-1vulnerable
Ubuntuc-ares24.041.27.0-1.0ubuntu1vulnerable
Ubuntuc-ares24.041.27.0-1.0ubuntu1.1fixed
Ubuntuc-ares26.041.34.5-1vulnerable
Ubuntuc-ares26.041.34.6-1vulnerable
Ubuntuc-ares26.041.34.6-1ubuntu0.1vulnerable
Ubuntuc-ares26.041.34.6-1ubuntu0.2fixed
Ubuntuc-aresnoble1.27.0-1.0ubuntu1.1fixed
Ubuntulibc-ares-devnoble1.27.0-1.0ubuntu1.1fixed
Ubuntulibcares2noble1.27.0-1.0ubuntu1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianc-aressourcesid1.34.7-1not yet assignedNot reportedNot reported
Debianc-aressourceforky1.34.7-1not yet assignedNot reportedNot reported
Debianc-aressourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianc-aressourcebookwormNot affectedunimportantNot reportedNot reported
Ubuntuc-aresdebpro1.15.0-1ubuntu0.5+esm1Not reportedUBUNTU-CVE-2026-69184Not reported
Ubuntuc-aresdeb22.041.18.1-1ubuntu0.22.04.4Not reportedUBUNTU-CVE-2026-69184Not reported
Ubuntuc-aresdeb24.041.27.0-1.0ubuntu1.1Not reportedUBUNTU-CVE-2026-69184Not reported
Ubuntuc-aresdeb26.041.34.6-1ubuntu0.2Not reportedUBUNTU-CVE-2026-69184Not reported
Ubuntuc-aresdebnoble1.27.0-1.0ubuntu1.1Not reportedNot reportedNot reported
Ubuntulibc-ares-devdebnoble1.27.0-1.0ubuntu1.1Not reportedNot reportedNot reported
Ubuntulibcares2debnoble1.27.0-1.0ubuntu1.1Not reportedNot reportedNot reported

Notes

[trixie] c-ares: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]