CVE-2026-69184

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

• CWE-407

• https://github.com/c-ares/c-ares/commit/5c8341ba6ff3a8e4e4dfd616f8ed0418838b8b7b
• https://github.com/c-ares/c-ares/commit/f1288bbc70e9a1e0a77134c2382157e52d326aea
• https://github.com/c-ares/c-ares/pull/1164
• https://github.com/c-ares/c-ares/pull/1210
• https://github.com/c-ares/c-ares/releases/tag/v1.34.7
• https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-69153PostCSS takes a CSS file and provides an API to analyze and …5.3
• CVE-2026-69159Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-6916The Jeg Kit for Elementor – Powerful Addons for Elementor, W…6.4
• CVE-2026-69160OpenList a file list program that supports multiple storage.…6.5
• CVE-2026-6918In Eclipse Open9J versions 0.21 to 0.58, a pre-authenticatio…7.5
• CVE-2026-69183Monkeytype is a minimalistic and customizable typing test. I…7.5
• CVE-2026-69185Socket.IO enables bidirectional and low-latency communicatio…7.5
• CVE-2026-69186c-ares is an asynchronous resolver library. Prior to 1.34.7,…5.3
• CVE-2026-69189Hoppscotch is an open source API development ecosystem. Prio…7.6
• CVE-2026-6919Use after free in DevTools in Google Chrome prior to 147.0.7…9.6
• CVE-2026-69190Graylog is a free and open log management platform. From 6.3…6.3
• CVE-2026-69192ip-address is a library for parsing and manipulating IPv4 an…7.7