CVE-2026-69184

A flaw was found in c-ares, an asynchronous resolver library. The 'aresdnsnameparse' function does not properly limit the total pointer hops or assembled name length when enforcing backward DNS compression pointers. A remote attacker, operating a malicious DNS server, can send a specially crafted...

AZL-103457 CVE-2026-69184 affecting package fluent-bit 3.1.10-7

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

AZL-103307 CVE-2026-69184 affecting package c-ares 1.30.0-2

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

CVE-2026-69184

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

CVE-2026-69184

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

CVE-2026-69184 c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

CVE-2026-69184 c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

CVE-2026-69184 c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

openSUSE 16 Security Update : perl-Net-DNS (openSUSE-SU-2026:21859-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21859-1 advisory. Changes in perl-Net-DNS: Updated to 1.570.0 1.57: See /usr/share/doc/packages/perl-Net-DNS/Changes . - Resync with IANA DNS parameters registry....

CVE-2026-69184: Inefficient Algorithmic Complexity

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

OPENSUSE-SU-2026:21859-1 Security update for perl-Net-DNS

This update for perl-Net-DNS fixes the following issues: Changes in perl-Net-DNS: Updated to 1.570.0 1.57: See /usr/share/doc/packages/perl-Net-DNS/Changes . - Resync with IANA DNS parameters registry. - EDNS: Add support for MQTYPE-QUERY option. - Unbounded recursion when re-encoding message wit...

Fedora 44 : perl-Net-DNS (2026-a0607111e6)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a0607111e6 advisory. Update to Net-DNS 1.56 from 1.53. Security fixes: - CVE-worthy: Remote code injection via EDNS EXTENDED ERROR rt.cpan 179945 - Denial of Service via...

Fedora 43 : perl-Net-DNS (2026-1237afef8a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1237afef8a advisory. Update to Net-DNS 1.56 from 1.53. Security fixes: - CVE-worthy: Remote code injection via EDNS EXTENDED ERROR rt.cpan 179945 - Denial of Service via...

openSUSE 16 Security Update : c-ares (openSUSE-SU-2026:21721-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21721-1 advisory. Updat to c-ares 1.36.8. - CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via aresgetaddrinfo over...

Updated c-ares packages fix security vulnerabilities

Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via aresgetaddrinfo over TCP. CVE-2026-33630 CPU-exhaustion denial of service via unbounded DNS name compression pointer chains. CVE-2026-69184 Memory-amplification denial of service via unvalidated DNS header...

SUSE-SU-2026:3872-1 Security update for libcares2

This update for libcares2 fixes the following issues: - CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via aresgetaddrinfo over TCP bsc1270416. - CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer...

Amazon Linux 2 : perl-Net-DNS, --advisory ALAS2-2026-3855 (ALAS-2026-3855)

The version of perl-Net-DNS installed on the remote host is prior to 0.72-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3855 advisory. Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains...

Amazon Linux 2023 : perl-Net-DNS, perl-Net-DNS-Nameserver, perl-Net-DNS-tests (ALAS2023-2026-2046)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2046 advisory. Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS...

Important: perl-Net-DNS

Issue Overview: Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call sta...

Important: perl-Net-DNS

Issue Overview: Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option RFC 8914 by tokenising the raw bytes and passing the result to Perl's eval...