CVE-2026-69186

MEDIUM 5.3

c-ares: Memory-amplification denial of service via unvalidated DNS header record counts

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

CWE	CWE-400
Vendor	c-ares
Product	c-ares
Published	Sep 18, 2026
Last Updated	Sep 18, 2026

Stay Ahead of the Next One

Get instant alerts for c-ares c-ares

Be the first to know when new medium vulnerabilities affecting c-ares c-ares are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

c-ares / c-ares

< 1.34.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj github.com: https://github.com/c-ares/c-ares/pull/1134 github.com: https://github.com/c-ares/c-ares/commit/e47c203f91cd8b749c8736bc18d75a31ffdec8f4 github.com: https://github.com/c-ares/c-ares/commit/eaded4cb200b2a5f8d73f11021ff7c8d6968aaab github.com: https://github.com/c-ares/c-ares/releases/tag/v1.34.7