Read the docs
TI-2026-48536 Aliases CVE-2026-69184

c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

Priority LOW 39CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-407.

Summary

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00479 41st percentileScored 2026-11-07
Fix Partial c-ares (c-ares): 1.34.7Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
c-aresc-aresbefore 1.34.71.34.7Patch availableCNA
  • c-ares Vendorc-ares Affected before 1.34.7 Fixed in 1.34.7 Patch available CNA

Remediation

  • Fix · CNA c-ares (c-ares) Fixed in 1.34.7

Red Hat 1 advisory

  • RHSA-2026:40574 Released 2026-07-16 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images c-ares-1.34.8-2.hum1@aarch64, c-ares-1.34.8-2.hum1@src, c-ares-1.34.8-2.hum1@x86_64 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 3Affected—
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat Hardened ImagesFixed RHSA-2026:40574
Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-69184
  2. 2026-10-23 EPSS moved to the below the 50th percentile
  3. 2026-10-23 Affected versions changed · Red Hat
  4. 2026-10-23 Priority changed: MEDIUM → LOW
  5. 2026-10-30 Affected versions changed · Red Hat

References

Other 6

  • TI-2026-48538 c-ares: Memory-amplification denial of service via unvalidated DNS header record counts CVSS 3.1MEDIUM 5.3
  • TI-2020-14305 Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function… CVSS 3.1MEDIUM 5.9
  • TI-2016-04481 Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0… CVSS 3.1CRITICAL 9.8
  • TI-2023-15371 0-byte UDP payload DoS in c-ares CVSS 3.1HIGH 7.5
  • TI-2026-26011 Double free in c-ares CVSS 3.1HIGH 7.5
  • TI-2017-14601 The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR… CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences