Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-69184— c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

Quick assessment

Affected
c-ares c-ares
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

c-ares 是一个异步域名解析库。在 1.34.7 版本之前， 函数虽然支持向后兼容的 DNS 压缩指针，但并未对指针跳转次数或组装后的完整域名长度设置上限。一个恶意的 DNS 服务器可以发送一个包含长降序指针链以及大量资源记录（其 NAME 或 RDATA 字段均引用该指针链）的响应，从而导致重复的解压操作，其计算量随消息大小呈平方级增长。一个精心构造的响应即可阻塞 c-ares 单线程事件循环，使 DNS 解析服务不可用，但不会引发内存损坏或信息泄露。该问题已在 1.34.7 版本中修复。

CVSS 7.5 · High EPSS 0.48% · P41

Affected Version Matrix 1

VendorProduct Version RangeStatus
c-ares c-ares < 1.34.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-69184

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
Source: CVE Program / CVE List V5
Vulnerability Description
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
c-ares c-ares < 1.34.7 -

II. Public POCs for CVE-2026-69184

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-69184

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-69184 (4)

Vendor Advisories for CVE-2026-69184 (1)

Vendor Pages for CVE-2026-69184 (1)

IV. Related Vulnerabilities

Same product: c-ares
Same vendor: c-ares
Same weakness: CWE-407