CVE-2026-69184

A flaw was found in c-ares, an asynchronous resolver library. The 'aresdnsnameparse' function does not properly limit the total pointer hops or assembled name length when enforcing backward DNS compression pointers. A remote attacker, operating a malicious DNS server, can send a specially crafted...

CVE-2026-69184

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

AZL-103457 CVE-2026-69184 affecting package fluent-bit 3.1.10-7

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

AZL-103307 CVE-2026-69184 affecting package c-ares 1.30.0-2

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

CVE-2026-69184

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

CVE-2026-69184 c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

CVE-2026-69184 c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the aresdnsnameparse function due to a lack of limits on the total pointer hops or assembled name length when processing DNS compression pointers. An attacker can cause excessive C...

CVE-2026-69184 c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

openSUSE 16 Security Update : perl-Net-DNS (openSUSE-SU-2026:21859-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21859-1 advisory. Changes in perl-Net-DNS: Updated to 1.570.0 1.57: See /usr/share/doc/packages/perl-Net-DNS/Changes . - Resync with IANA DNS parameters registry....

CVE-2026-69184: Inefficient Algorithmic Complexity

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

OPENSUSE-SU-2026:21859-1 Security update for perl-Net-DNS

This update for perl-Net-DNS fixes the following issues: Changes in perl-Net-DNS: Updated to 1.570.0 1.57: See /usr/share/doc/packages/perl-Net-DNS/Changes . - Resync with IANA DNS parameters registry. - EDNS: Add support for MQTYPE-QUERY option. - Unbounded recursion when re-encoding message wit...

Fedora 43 : perl-Net-DNS (2026-1237afef8a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1237afef8a advisory. Update to Net-DNS 1.56 from 1.53. Security fixes: - CVE-worthy: Remote code injection via EDNS EXTENDED ERROR rt.cpan 179945 - Denial of Service via...

Fedora 44 : perl-Net-DNS (2026-a0607111e6)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a0607111e6 advisory. Update to Net-DNS 1.56 from 1.53. Security fixes: - CVE-worthy: Remote code injection via EDNS EXTENDED ERROR rt.cpan 179945 - Denial of Service via...

openSUSE 16 Security Update : c-ares (openSUSE-SU-2026:21721-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21721-1 advisory. Updat to c-ares 1.36.8. - CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via aresgetaddrinfo over...

Updated c-ares packages fix security vulnerabilities

Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via aresgetaddrinfo over TCP. CVE-2026-33630 CPU-exhaustion denial of service via unbounded DNS name compression pointer chains. CVE-2026-69184 Memory-amplification denial of service via unvalidated DNS header...

SUSE-SU-2026:3872-1 Security update for libcares2

This update for libcares2 fixes the following issues: - CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via aresgetaddrinfo over TCP bsc1270416. - CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer...

Amazon Linux 2023 : perl-Net-DNS, perl-Net-DNS-Nameserver, perl-Net-DNS-tests (ALAS2023-2026-2046)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2046 advisory. Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS...

Amazon Linux 2 : perl-Net-DNS, --advisory ALAS2-2026-3855 (ALAS-2026-3855)

The version of perl-Net-DNS installed on the remote host is prior to 0.72-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3855 advisory. Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains...

Important: perl-Net-DNS

Issue Overview: Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call sta...