Affected: Alpaquita:25: c-ares, Alpaquita:stream: c-ares, BellSoft Hardened Containers:25: c-ares, BellSoft Hardened Containers:stream: c-ares

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

c-ares-devel-1.34.8-1.1 on GA media

c-ares: c-ares: CPU exhaustion denial of service via unbounded DNS name compression pointer chains c-ares: c-ares: Denial of Service via unvalidated DNS header record counts

Security update for c-ares

Affected: Ubuntu:Pro:16.04:LTS: c-ares, Ubuntu:Pro:18.04:LTS: c-ares, Ubuntu:20.04:LTS: c-ares, Ubuntu:22.04:LTS: c-ares, Ubuntu:24.04:LTS: c-ares, Ubuntu:26.04:LTS: c-ares

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.