# CVE-2026-69186: c-ares: Memory-amplification denial of service via unvalidated DNS header record counts

CVE-2026-69186 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2026-69186, released August 11, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-69186
- Priority: Routine
- CVSS: 5.3 (Moderate)
- EPSS: 0.0047
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 1, 2026
- Weakness: Uncontrolled Resource Consumption
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69186

## Description

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | c-ares Debian 14 | 1.34.7-1 | [DEBIAN-CVE-2026-69186](https://patchblox.com/security/data/fix/linux/debian-cve-2026-69186.md) | Aug 11, 2026 |
| Linux | c-ares opensuse-leap 16.0 | 1.34.8-160000.1.1 | [OPENSUSE-SU-2026:21721-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21721-1.md) | Sep 1, 2026 |
| Linux | c-ares sles 15.6 | 1.34.8-150000.3.29.1 | [SUSE-SU-2026:4021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4021-1.md) | Sep 7, 2026 |
| Linux | c-ares sles 15.7 | 1.34.8-150000.3.29.1 | [SUSE-SU-2026:4021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4021-1.md) | Sep 7, 2026 |
| Linux | c-ares sles 16.0 | 1.34.8-160000.1.1 | [SUSE-SU-2026:23597-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23597-1.md) | Sep 1, 2026 |
| Linux | libc-ares2 Ubuntu 26.04.1 LTS (resolute) | 1.34.6-1ubuntu0.2 | [libc-ares2 1.34.6-1ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libc-ares2-1.34.6-1ubuntu0.2.md) | Sep 18, 2026 |
| Linux | libcares2 Ubuntu 24.04.5 LTS (noble) | 1.27.0-1.0ubuntu1.1 | [libcares2 1.27.0-1.0ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libcares2-1.27.0-1.0ubuntu1.1.md) | Sep 18, 2026 |
| Linux | libcares2 Ubuntu 26.04.1 LTS (resolute) | 1.34.6-1ubuntu0.2 | [libcares2 1.34.6-1ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libcares2-1.34.6-1ubuntu0.2.md) | Sep 18, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.