CVE-2026-69184: c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
c-aresto a version that resolves this vulnerability.Fixed in 1.34.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to control, compromise, or otherwise be able to provide DNS responses from a server queried by the affected c-ares client. No authentication or user interaction is required.
Are applications using the default c-ares resolver behavior affected?
The issue is in ares_dns_name_parse() before version 1.34.7 and is triggered while parsing a crafted DNS response. The provided information does not identify a configuration option that disables the vulnerable parsing behavior.
What is the practical impact on an affected application?
One crafted DNS response can cause repeated decompression work that grows quadratically with message size. This can stall c-ares' single-threaded event loop and prevent DNS resolution, but the issue does not cause memory corruption or information disclosure.
How can I determine whether my deployment is affected?
Check the version of the c-ares library used by the application. Versions earlier than 1.34.7 are affected; version 1.34.7 contains the fix.
What should be done if an upgrade cannot be applied immediately?
The supplied information identifies malicious DNS responses as the attack vector but does not provide a documented workaround. Limit exposure to untrusted or attacker-controlled DNS servers until c-ares can be updated to 1.34.7.