Executive brief
c-ares is a DNS resolver library used by many applications for network name lookups. A malicious DNS response can trick the library into allocating excessive heap memory by claiming to contain many DNS records it does not actually provide. An attacker could repeatedly send crafted responses to degrade or deny DNS resolution service, affecting any application or system that relies on this library.
Technical details
The vulnerability exists in ares_dns_parse() which trusts attacker-controlled record count fields (ANCOUNT, NSCOUNT, ARCOUNT) before validating that the DNS response packet contains enough bytes for the claimed records. The parser calls process_answer() before transaction ID and question validation, allowing ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate memory for tiny messages. Repeated malformed responses cause large allocation and release cycles that degrade name resolution without memory corruption or information disclosure. The fix validates RR counts against remaining buffer size before preallocation.
Affected products
- c-ares project c-ares before 1.34.7
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Version 1.34.7 released