CVE-2026-69186

c-ares , an asynchronous DNS resolver library, is affected by a memory-amplification denial of service in ares_dns_parse(). Prior to 1.34.7 , the function trusts attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT header fields without first confirming the response contains enough bytes for the cla...

CVE-2026-69186 c-ares: Memory-amplification denial of service via unvalidated DNS header record counts

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsparse trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because processanswer invokes parsing before transaction ID and...