Executive brief
c-ares is a DNS resolver library used by many applications to look up hostnames. A malicious DNS server can send a specially crafted response that causes the resolver to consume excessive CPU time and become unresponsive, denying legitimate DNS queries. An attacker on the network path can exploit this without special access or credentials.
Technical details
The ares_dns_name_parse() function failed to bound the total accumulated name length or the number of compression pointer indirections when parsing DNS messages. An attacker can construct a response with a long chain of backward DNS compression pointers and multiple resource records referencing this chain, causing quadratic expansion in parsing work. The fix enforces a 255-octet name limit and caps compression pointer indirections at 128 per name.
Affected products
- c-ares c-ares before 1.34.7
Timeline
- 2026-09-18: disclosed: CVE-2026-69184 published
- 2026-07-02: patched: Fix committed to c-ares main branch