Skip to content
OpenAdvisories
High RLSA-2026:98629 2 CVEs

Important: c-ares security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Rocky Linux

Summary

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

* c-ares: c-ares: Denial of Service via unvalidated DNS header record counts (CVE-2026-69186)

* c-ares: c-ares: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (CVE-2026-69184)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 16

ReleasePackageFixed in
Rocky Linux · 10 c-ares 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares-debuginfo 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares-debuginfo 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares-debuginfo 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares-debuginfo 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares-debugsource 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares-debugsource 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares-debugsource 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares-debugsource 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares-devel 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares-devel 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares-devel 0:1.34.6-5.el10_3.2
Rocky Linux · 10 c-ares-devel 0:1.34.6-5.el10_3.2

Vulnerabilities 2

  • High 7.5
    CVE-2026-69184

    c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

    c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long desc…

    c-ares c-ares fluent-bit c-ares Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-69186

    c-ares: Memory-amplification denial of service via unvalidated DNS header record counts

    c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() i…

    c-ares c-ares fluent-bit c-ares Debian Ubuntu Azure Linux

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2538212
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2538396
  • advisory
    https://access.redhat.com/errata/RHSA-2026:98629