Vulnerability Intelligence Report
c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
CVE-2026-69184
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.
No Active Exploit Signals
CVSS Base Score
7.5
HIGH
Exploitability:3.9
Impact Score:3.6
EPSS Probability:0.68%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-407 ↗CWE-407: Inefficient Algorithmic Complexity
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| c-ares | c-ares | < 1.34.7 (affected) |
Threat Intelligence Signals
EPSS Score
0.675%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2026-08-03T16:00:23 |
| Published | 2026-09-18T17:26:52 |
| Last Updated | 2026-09-21T20:48:59 |
Community Chatter & Buzz