# CVE-2026-69184: c-ares DNS name parsing ReDoS

Source: https://junglewise.ai/threats/cve-2026-69184-c-ares-is-an-asynchronous-resolver-library-prior-to-1-34-7-ares  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-69184 · Severity: high · CVSS 7.5 · Published 2026-09-18

c-ares is a DNS resolver library used by many applications to look up hostnames. A malicious DNS server can send a specially crafted response that causes the resolver to consume excessive CPU time and become unresponsive, denying legitimate DNS queries. An attacker on the network path can exploit this without special access or credentials.

Technologies: [C-Ares](https://junglewise.ai/threats/technologies/c-ares). Vendors: [C-Ares](https://junglewise.ai/threats/vendors/c-ares).

## Quick answers

**Is CVE-2026-69184 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69184 being exploited in the wild.

**How severe is CVE-2026-69184?** High severity, with a CVSS score of 7.5, published 18 September 2026.

**Which products and versions are affected?** C-Ares before 1.34.7.

**Is there a fix for CVE-2026-69184?** A patch was published on 2026-07-02: Fix committed to c-ares main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69184 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69184?** Check whether you run C-Ares at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ares_dns_name_parse() function failed to bound the total accumulated name length or the number of compression pointer indirections when parsing DNS messages. An attacker can construct a response with a long chain of backward DNS compression pointers and multiple resource records referencing this chain, causing quadratic expansion in parsing work. The fix enforces a 255-octet name limit and caps compression pointer indirections at 128 per name.

## Affected products

- c-ares c-ares before 1.34.7

## Timeline

- 2026-09-18: disclosed: CVE-2026-69184 published
- 2026-07-02: patched: Fix committed to c-ares main branch

## References

- [https://github.com/c-ares/c-ares/commit/5c8341ba6ff3a8e4e4dfd616f8ed0418838b8b7b](https://github.com/c-ares/c-ares/commit/5c8341ba6ff3a8e4e4dfd616f8ed0418838b8b7b)
- [https://github.com/c-ares/c-ares/commit/f1288bbc70e9a1e0a77134c2382157e52d326aea](https://github.com/c-ares/c-ares/commit/f1288bbc70e9a1e0a77134c2382157e52d326aea)

## Related threats

- [c-ares use-after-free / double-free in query-completion handling](https://junglewise.ai/threats/cve-2026-33630-c-ares-use-after-free-double-free-in-query-completion-handling)
- [c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts…](https://junglewise.ai/threats/cve-2025-62408-c-ares-is-an-asynchronous-resolver-library-versions-1-32-3)