Skip to content
OpenAdvisories
High USN-8951-1 4 CVEs

c-ares vulnerabilities

Published Oct 21, 2026 · Updated Oct 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that c-ares incorrectly parsed certain SOA replies. A
remote attacker could possibly use this issue to cause c-ares to crash,
resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS
and Ubuntu 18.04 LTS. (CVE-2020-22217)

It was discovered that c-ares incorrectly handled certain sortlist strings.
A remote attacker could possibly use this issue to cause c-ares to crash,
resulting in a denial of service, or execute arbitrary code. This issue
only affected Ubuntu 16.04 LTS. (CVE-2022-4904)

It was discovered that c-ares did not properly limit DNS compression
pointer hops or assembled name lengths when parsing DNS names. A remote
attacker could possibly use this issue to cause c-ares to use excessive
resources, resulting in a denial of service. (CVE-2026-69184)

It was discovered that c-ares did not properly validate record count fields
before allocating memory when parsing DNS responses. A remote attacker
could possibly use this issue to cause c-ares to use excessive resources,
resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS
and Ubuntu 26.04 LTS. (CVE-2026-69186)

Fixed packages 6

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS c-ares 1.18.1-1ubuntu0.22.04.4
Ubuntu · 24.04 LTS 24.04:LTS c-ares 1.27.0-1.0ubuntu1.1
Ubuntu · 26.04 LTS 26.04:LTS c-ares 1.34.6-1ubuntu0.2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS c-ares 1.10.0-3ubuntu0.2+esm4
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS c-ares 1.14.0-1ubuntu0.2+esm3
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS c-ares 1.15.0-1ubuntu0.5+esm1

Vulnerabilities 4

  • High 8.6
    CVE-2022-4904

    A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,…

    nodejs c-ares grpc c-ares Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-69184

    c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

    c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long desc…

    c-ares c-ares fluent-bit c-ares Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-69186

    c-ares: Memory-amplification denial of service via unvalidated DNS header record counts

    c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() i…

    c-ares c-ares fluent-bit c-ares Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2020-22217

    Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_r…

    c-ares c-ares python-gevent Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2020-22217
  • report
    https://ubuntu.com/security/CVE-2022-4904
  • report
    https://ubuntu.com/security/CVE-2026-69184
  • report
    https://ubuntu.com/security/CVE-2026-69186