Read the docs
TI-2026-48538 Aliases CVE-2026-69186

c-ares: Memory-amplification denial of service via unvalidated DNS header record counts

Priority MEDIUM 63CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00466 40th percentileScored 2026-11-07
Fix Partial c-ares (c-ares): 1.34.7Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
c-aresc-aresbefore 1.34.71.34.7Patch availableCNA
  • c-ares Vendorc-ares Affected before 1.34.7 Fixed in 1.34.7 Patch available CNA

Remediation

  • Fix · CNA c-ares (c-ares) Fixed in 1.34.7

Red Hat 1 advisory

  • RHSA-2026:40574 Released 2026-07-16 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images c-ares-1.34.8-2.hum1@aarch64, c-ares-1.34.8-2.hum1@src, c-ares-1.34.8-2.hum1@x86_64 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 3Affected—
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat Hardened ImagesFixed RHSA-2026:40574
Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-69186
  2. 2026-10-23 Affected versions changed · Red Hat
  3. 2026-10-30 Affected versions changed · Red Hat

References

Other 5

  • TI-2020-14305 Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function… CVSS 3.1MEDIUM 5.9
  • TI-2016-04481 Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0… CVSS 3.1CRITICAL 9.8
  • TI-2023-15371 0-byte UDP payload DoS in c-ares CVSS 3.1HIGH 7.5
  • TI-2026-26011 Double free in c-ares CVSS 3.1HIGH 7.5
  • TI-2026-48536 c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains CVSS 3.1HIGH 7.5
  • TI-2017-14601 The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR… CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences