RLSA-2026:98629: Important: c-ares security update
The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.
Security Fix(es):
c-ares: c-ares: Denial of Service via unvalidated DNS header record counts (CVE-2026-69186)
c-ares: c-ares: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (CVE-2026-69184)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/c-ares-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.34.6-5.el10_3.2 - Upgrade
Upgrade
rocky-linux/c-aresto a version that resolves this vulnerability.Fixed in 0:1.34.6-5.el10_3.2 - Upgrade
Upgrade
rocky-linux/c-ares-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.34.6-5.el10_3.2 - Upgrade
Upgrade
rocky-linux/c-ares-develto a version that resolves this vulnerability.Fixed in 0:1.34.6-5.el10_3.2
Event History
Frequently Asked Questions
What kind of impact can these flaws have?
Both issues can cause denial of service. One involves unvalidated DNS header record counts, and the other can cause CPU exhaustion through unbounded DNS name compression pointer chains.
What must an attacker be able to do to exploit these issues?
The CVSS vector indicates network-based exploitation with low attack complexity, no privileges, and no user interaction required. The provided data does not further specify the required network position or traffic path.
Which Rocky Linux packages are covered by this update?
The advisory covers c-ares, c-ares-debuginfo, c-ares-debugsource, and c-ares-devel.