CVE-2026-69184— c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
Quick assessment
Affected
c-ares c-ares
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long desce
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-69184
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
Source: CVE Program / CVE List V5
Vulnerability Description
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-69184
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-69184
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-69184 (4)
Vendor Advisories for CVE-2026-69184 (1)
Vendor Pages for CVE-2026-69184 (1)
-
🔗 Release 1.34.7 · c-ares/c-ares · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: c-ares
-
CVE-2026-69186
c-ares: Memory-amplification denial of service via unvalidat -
CVE-2026-33630
c-ares : Use-after-free / double-free in c-ares query-comple -
CVE-2025-62408
c-ares has a Use After Free vulnerability when connection is -
CVE-2025-31498
c-ares has a use-after-free in read_answers() -
CVE-2024-25629
c-ares out of bounds read in ares__read_line()
Same vendor: c-ares
-
CVE-2026-69186
c-ares: Memory-amplification denial of service via unvalidat -
CVE-2026-33630
c-ares : Use-after-free / double-free in c-ares query-comple -
CVE-2025-62408
c-ares has a Use After Free vulnerability when connection is -
CVE-2025-31498
c-ares has a use-after-free in read_answers() -
CVE-2024-25629
c-ares out of bounds read in ares__read_line()
Same weakness: CWE-407
-
CVE-2026-71418
Suricata doh2: crafted HTTP/2 DATA frames can cause quadrati -
CVE-2026-63447
Suricata ftp: crafted FTP traffic can cause quadratic CPU co -
CVE-2026-44639
NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing -
CVE-2026-92987
roxmltree through 0.21.1 Denial of Service via Quadratic Par -
CVE-2026-82760
Superlinear base62 decoding exhausts CPU and memory in AshAu
V. Comments for CVE-2026-69184
No comments yet