https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:27:36 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-69184 <p><strong>Affected:</strong> Alpaquita:25: c-ares, Alpaquita:stream: c-ares, BellSoft Hardened Containers:25: c-ares, BellSoft Hardened Containers:stream: c-ares</p> <p><strong>Affected:</strong> Alpaquita:25: c-ares, Alpaquita:stream: c-ares, BellSoft Hardened Containers:25: c-ares, BellSoft Hardened Containers:stream: c-ares</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-69184 https://cve.radiocsirt.org/vuln/euvd-2026-373295 EUVD-2026-373295 https://cve.radiocsirt.org/vuln/euvd-2026-373295 https://cve.radiocsirt.org/vuln/fkie_cve-2026-69184 <p>c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.</p> <p>c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-69184 https://cve.radiocsirt.org/vuln/msrc_cve-2026-69184 msrc_CVE-2026-69184 https://cve.radiocsirt.org/vuln/msrc_cve-2026-69184 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11593-1 <p>c-ares-devel-1.34.8-1.1 on GA media</p> <p>c-ares-devel-1.34.8-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11593-1 https://cve.radiocsirt.org/vuln/rhsa-2026:40574 <p>c-ares: c-ares: CPU exhaustion denial of service via unbounded DNS name compression pointer chains c-ares: c-ares: Denial of Service via unvalidated DNS header record counts</p> <p>c-ares: c-ares: CPU exhaustion denial of service via unbounded DNS name compression pointer chains c-ares: c-ares: Denial of Service via unvalidated DNS header record counts</p> https://cve.radiocsirt.org/vuln/rhsa-2026:40574 https://cve.radiocsirt.org/vuln/suse-su-2026:23364-1 <p>Security update for c-ares</p> <p>Security update for c-ares</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23364-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-69184 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: c-ares, Ubuntu:Pro:18.04:LTS: c-ares, Ubuntu:20.04:LTS: c-ares, Ubuntu:22.04:LTS: c-ares, Ubuntu:24.04:LTS: c-ares, Ubuntu:26.04:LTS: c-ares</p> <p>c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: c-ares, Ubuntu:Pro:18.04:LTS: c-ares, Ubuntu:20.04:LTS: c-ares, Ubuntu:22.04:LTS: c-ares, Ubuntu:24.04:LTS: c-ares, Ubuntu:26.04:LTS: c-ares</p> <p>c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-69184