CVE-2026-69186: c-ares Uncontrolled Resource Consumption

Vulnerability summary

CVE-2026-69186 is a medium (CVSS 5.3) Uncontrolled Resource Consumption vulnerability in c-ares. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.5% of scored vulnerabilities.

Timeline

1. 18-09-2026
   PublishedVulnerability first disclosed.
2. 18-09-2026
   Last modifiedVulnerability information updated.

Description

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.