Medium severity · published Sep 18, 2026
CVE-2026-69186
c-ares: Memory-amplification denial of service via unvalidated DNS header record counts
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
c-ares · c-ares
< 1.34.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-69186
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-69186
github.com
https://github.com/c-ares/c-ares/commit/e47c203f91cd8b749c8736bc18d75a31ffdec8f4
github.com
https://github.com/c-ares/c-ares/commit/eaded4cb200b2a5f8d73f11021ff7c8d6968aaab
github.com
https://github.com/c-ares/c-ares/pull/1134
github.com
https://github.com/c-ares/c-ares/releases/tag/v1.34.7
github.com
https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj
More from c-ares
9.8
CVE-2016-5180
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly…
7.5
CVE-2026-69184
c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
7.5
CVE-2026-33630
c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP
7.5
CVE-2017-1000381
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS…
5.9
CVE-2025-62408
c-ares has a Use After Free vulnerability when connection is cleaned up after error