CVE-2026-69186
c-ares is an asynchronous resolver library
- Risk score
- 45/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 18 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation…
- Affected
- Canonical Ubuntu Linux before 1.34.7
- Fix
- Upgrade Canonical Ubuntu Linux to 1.34.7 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Amber, patch this week. U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.
The flaws
- CVE-2026-69186: C-ares is an asynchronous resolver library (CVSS 5.3 · EPSS 0%)
- CVE-2026-74221: Denial of service (CVSS 8.2 · EPSS 0%)
- CVE-2026-74220: Denial of service (CVSS 8.2 · EPSS 0%)
- CVE-2026-103262: Denial of service (CVSS 7.5 · EPSS 1%)
The fix
Upgrade Canonical Ubuntu Linux: 1.34.7 · 2026.10 · 6.5.9 or later on your release line
Who is exposed: Canonical Ubuntu Linux before 2026.10
Where it stands
- No known exploitation
How it unfolded
- 21 Oct, Ubuntu security notices (official): USN-8930-2: U-Boot vulnerabilities
- 21 Oct, Ubuntu security notices (official): USN-8951-1: c-ares vulnerabilities
- 22 Oct, Ubuntu security notices (official): USN-8952-1: Tornado vulnerabilities
Connects to
- Same weakness: Denial of service (CWE-400). 256 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 15 in the last 90 days
Why it is Yellow
- CVSS 5.3 medium
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-8951-1
- https://github.com/c-ares/c-ares/commit/e47c203f91cd8b749c8736bc18d75a31ffdec8f4
- https://github.com/c-ares/c-ares/commit/eaded4cb200b2a5f8d73f11021ff7c8d6968aaab
- https://github.com/c-ares/c-ares/pull/1134
- https://github.com/c-ares/c-ares/releases/tag/v1.34.7
- https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj
- https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj
Original description
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.
Last activity 21 Oct 2026. Patch Forecast updates every hour.