CVE-2026-69184

A flaw was found in c-ares, an asynchronous resolver library. The 'ares_dns_name_parse()' function does not properly limit the total pointer hops or assembled name length when enforcing backward DNS compression pointers. A remote attacker, operating a malicious DNS server, can send a specially crafted DNS response containing a long descending pointer chain. This can lead to excessive CPU consumption, causing the single-threaded c-ares event loop to stall and resulting in a denial of service for DNS resolution.

A flaw was found in the c-ares asynchronous DNS resolver library. Red Hat rates this flaw as Important. A remote attacker who can supply DNS responses to an application using a vulnerable c-ares build can send a crafted DNS message containing a long compression-pointer chain that causes quadratic name-decompression work in ares_dns_name_parse(). Because c-ares uses a single-threaded event loop, a single crafted response can stall DNS resolution for the process. Impact is limited to availability; the flaw does not cause memory corruption or information disclosure. The vulnerable DNS name parser is present in c-ares 1.21 and later through 1.34.6 and is fixed in 1.34.7. Red Hat Enterprise Linux 10 ships c-ares 1.25.0 or 1.34.6 and is affected. Red Hat Enterprise Linux 6, 7, 8, and 9 ship older c-ares versions (1.10.x through 1.19.x) that do not include this parser and are not affected. Red Hat's CVSS v3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), matching the upstream High rating, because one crafted response is sufficient to deny name resolution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure applications that use c-ares to query only trusted DNS resolvers over a trusted network path. Restrict DNS responses from untrusted sources so a malicious or on-path resolver cannot deliver crafted replies.