UBUNTU-CVE-2026-69186

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-69186
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-69186.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-69186
Upstream
Published
2026-09-18T18:17:00Z
Modified
2026-09-29T23:41:07Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

References

Affected packages

Ubuntu:20.04:LTS
c-ares

Package

Name
c-ares
Purl
pkg:deb/ubuntu/c-ares?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.15.0-1build1
1.15.0-1ubuntu0.1
1.15.0-1ubuntu0.2
1.15.0-1ubuntu0.3
1.15.0-1ubuntu0.4
1.15.0-1ubuntu0.5

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libc-ares2",
            "binary_version": "1.15.0-1ubuntu0.5"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-69186.json"
Ubuntu:22.04:LTS
c-ares

Package

Name
c-ares
Purl
pkg:deb/ubuntu/c-ares?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.17.1-1ubuntu1
1.18.1-1
1.18.1-1build1
1.18.1-1ubuntu0.22.04.1
1.18.1-1ubuntu0.22.04.2
1.18.1-1ubuntu0.22.04.3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libc-ares2",
            "binary_version": "1.18.1-1ubuntu0.22.04.3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-69186.json"
Ubuntu:24.04:LTS
c-ares

Package

Name
c-ares
Purl
pkg:deb/ubuntu/c-ares?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.19.1-3
1.20.1-1
1.26.0-1
1.27.0-1
1.27.0-1.0ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libcares2",
            "binary_version": "1.27.0-1.0ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-69186.json"
Ubuntu:26.04:LTS
c-ares

Package

Name
c-ares
Purl
pkg:deb/ubuntu/c-ares?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.34.5-1
1.34.6-1
1.34.6-1ubuntu0.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libc-ares2",
            "binary_version": "1.34.6-1ubuntu0.1"
        },
        {
            "binary_name": "libcares2",
            "binary_version": "1.34.6-1ubuntu0.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-69186.json"
Ubuntu:Pro:16.04:LTS
c-ares

Package

Name
c-ares
Purl
pkg:deb/ubuntu/c-ares?arch=source&distro=esm-infra%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.10.0-2
1.10.0-3
1.10.0-3ubuntu0.1
1.10.0-3ubuntu0.2
1.10.0-3ubuntu0.2+esm1
1.10.0-3ubuntu0.2+esm2
1.10.0-3ubuntu0.2+esm3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libc-ares2",
            "binary_version": "1.10.0-3ubuntu0.2+esm3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-69186.json"
Ubuntu:Pro:18.04:LTS
c-ares

Package

Name
c-ares
Purl
pkg:deb/ubuntu/c-ares?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.13.0-2
1.13.0-3
1.14.0-1
1.14.0-1ubuntu0.1
1.14.0-1ubuntu0.2
1.14.0-1ubuntu0.2+esm1
1.14.0-1ubuntu0.2+esm2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libc-ares2",
            "binary_version": "1.14.0-1ubuntu0.2+esm2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-69186.json"