CVE-2026-69186: c-ares: Memory-amplification denial of service via unvalidated DNS header record counts
c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsparse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because processanswer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause aresdnsrecordrrprealloc() and aresarraysetsize() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
c-aresto a version that resolves this vulnerability.Fixed in 1.34.7 - Compensating control
If immediate upgrade is not possible, mitigate repeated-response heap allocation/release amplification by throttling or filtering DNS traffic/responses at the network layer (e.g., restrict resolver access to trusted sources and apply DNS rate-limiting).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using c-ares versions earlier than 1.34.7 are affected where they process malicious DNS responses. The impact is degradation or denial of name resolution through excessive heap allocation.
What does an attacker need to exploit it?
An attacker needs to cause the resolver to receive a malicious DNS response containing inflated answer, authority, or additional-record count fields. No authentication or user interaction is required.
Why can spoofed or otherwise invalid responses still trigger the issue?
The affected processing path parses DNS records before validating the transaction ID and question. As a result, allocation can occur based on attacker-controlled record counts before those response checks are completed.
How can the issue be remediated?
Upgrade c-ares to version 1.34.7, which fixes the unvalidated DNS header record-count handling.