CVE-2026-69186

A flaw was found in c-ares, an asynchronous resolver library. A remote attacker can send a specially crafted DNS response that causes the ares_dns_parse() function to trust attacker-controlled record counts without validating if the response contains enough bytes for the claimed records. This can lead to disproportionate heap memory reservation, resulting in a memory-amplification denial of service (DoS) by degrading or denying name resolution.

A flaw was found in the c-ares asynchronous DNS resolver library. Red Hat rates this flaw as Important. A remote attacker who can supply DNS responses to an application using a vulnerable c-ares build can send a crafted DNS message in which attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT header fields are trusted by ares_dns_parse() before the library verifies that the response contains enough bytes for the claimed records. Because parsing runs before transaction ID and question validation, a very small message can trigger pre-allocation of disproportionately large resource-record arrays on the heap, and repeated malicious responses can drive large allocation and release cycles that degrade or deny name resolution. Impact is limited to availability; the flaw does not cause memory corruption or information disclosure. The vulnerable pre-allocation path was introduced with the modern DNS record parser (c-ares 1.21 and later) and is fixed in 1.34.7. Red Hat Enterprise Linux 10 ships c-ares 1.25.0 or 1.34.6 and is affected. Red Hat Enterprise Linux 6, 7, 8, and 9 ship older c-ares versions that do not include this parser and are not affected. Red Hat's severity of Important (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is higher than the upstream Moderate rating (CVSS 5.3, A:L) because Red Hat assesses the availability impact of sustained malicious DNS responses on name resolution as high.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure applications that use c-ares to query only trusted DNS resolvers over a trusted network path (CME-202 host firewall; CME-203 network segmentation). Restrict DNS responses from untrusted sources so a malicious or on-path resolver cannot deliver crafted replies. There is no complete library-level workaround; apply a fixed c-ares update when available.