Memory Allocation Vulnerability in c-ares Resolver Library by c-ares

CVE-2026-69186

What is CVE-2026-69186?

The c-ares library, an asynchronous DNS resolver, is affected by a memory allocation flaw where the ares_dns_parse() function inadequately validates the ANCOUNT, NSCOUNT, and ARCOUNT fields in DNS responses. This oversight allows attackers to exploit the library by sending malicious DNS responses, leading to excessive heap memory reservations during parsing. Although this vulnerability does not cause memory corruption or information leakage, it can result in significant performance degradation or denial of name resolution through repeated large memory allocation cycles. The issue is resolved in version 1.34.7.

References