CVE-2026-69186
Description
A flaw was found in c-ares, an asynchronous resolver library. A remote attacker can send a specially crafted DNS response that causes the ares_dns_parse() function to trust attacker-controlled record counts without validating if the response contains enough bytes for the claimed records. This can lead to disproportionate heap memory reservation, resulting in a memory-amplification denial of service (DoS) by degrading or denying name resolution.
Statement
A flaw was found in the c-ares asynchronous DNS resolver library. Red Hat rates this flaw as Important. A remote attacker who can supply DNS responses to an application using a vulnerable c-ares build can send a crafted DNS message in which attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT header fields are trusted by ares_dns_parse() before the library verifies that the response contains enough bytes for the claimed records. Because parsing runs before transaction ID and question validation, a very small message can trigger pre-allocation of disproportionately large resource-record arrays on the heap, and repeated malicious responses can drive large allocation and release cycles that degrade or deny name resolution. Impact is limited to availability; the flaw does not cause memory corruption or information disclosure. The vulnerable pre-allocation path was introduced with the modern DNS record parser (c-ares 1.21 and later) and is fixed in 1.34.7. Red Hat Enterprise Linux 10 ships c-ares 1.25.0 or 1.34.6 and is affected. Red Hat Enterprise Linux 6, 7, 8, and 9 ship older c-ares versions that do not include this parser and are not affected. Red Hat's severity of Important (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is higher than the upstream Moderate rating (CVSS 5.3, A:L) because Red Hat assesses the availability impact of sustained malicious DNS responses on name resolution as high.
Mitigation
Configure applications that use c-ares to query only trusted DNS resolvers over a trusted network path (CME-202 host firewall; CME-203 network segmentation). Restrict DNS responses from untrusted sources so a malicious or on-path resolver cannot deliver crafted replies. There is no complete library-level workaround; apply a fixed c-ares update when available.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
