CVE-2026-69186

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

• CWE-400

• https://github.com/c-ares/c-ares/commit/e47c203f91cd8b749c8736bc18d75a31ffdec8f4
• https://github.com/c-ares/c-ares/commit/eaded4cb200b2a5f8d73f11021ff7c8d6968aaab
• https://github.com/c-ares/c-ares/pull/1134
• https://github.com/c-ares/c-ares/releases/tag/v1.34.7
• https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj
• https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj

Published

Sep 18, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6916The Jeg Kit for Elementor – Powerful Addons for Elementor, W…6.4
• CVE-2026-69160OpenList a file list program that supports multiple storage.…6.5
• CVE-2026-6918In Eclipse Open9J versions 0.21 to 0.58, a pre-authenticatio…7.5
• CVE-2026-69183Monkeytype is a minimalistic and customizable typing test. I…7.5
• CVE-2026-69184c-ares is an asynchronous resolver library. Prior to 1.34.7,…7.5
• CVE-2026-69185Socket.IO enables bidirectional and low-latency communicatio…7.5
• CVE-2026-69189Hoppscotch is an open source API development ecosystem. Prio…7.6
• CVE-2026-6919Use after free in DevTools in Google Chrome prior to 147.0.7…9.6
• CVE-2026-69190Graylog is a free and open log management platform. From 6.3…6.3
• CVE-2026-69192ip-address is a library for parsing and manipulating IPv4 an…7.7
• CVE-2026-69197Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.…8.7
• CVE-2026-69198ip-address is a library for parsing and manipulating IPv4 an…6.9