{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-69184 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-69184 is a high-severity denial of service vulnerability in c-ares, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-69184 and fix it if it is affected.\n\nWhat it is: CVE-2026-69184 is a high-severity denial of service vulnerability in c-ares, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-69184 in the wild and no public exploit code.\n\nAffected product: c-ares. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-69184/ (Markdown: https://insights.sbomify.com/CVE-2026-69184/index.md)","id":"CVE-2026-69184","markdown":"https://insights.sbomify.com/CVE-2026-69184/index.md","name":"CVE-2026-69184","record":{"aliases":["AZL-103307","AZL-103457","BELL-CVE-2026-69184","DEBIAN-CVE-2026-69184","ECHO-f279-6f91-2224","GHSA-pjmc-gx33-gc76","MINI-m34w-w535-pvvw","ROOT-OS-ALPINE-320-CVE-2026-69184","UBUNTU-CVE-2026-69184"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"c-ares DNS resolver library","requires_auth":"none","summary":"A malicious DNS server can cause CPU exhaustion and deny DNS resolution in c-ares by sending crafted responses with unbounded compression pointer chains.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-407","name":"Inefficient Algorithmic Complexity"}],"description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains","id":"CVE-2026-69184","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":6,"next":{"headline":"Socket.IO: Zero-attachment Memory Exhaustion","id":"CVE-2026-69185"},"packages":[],"prev":{"headline":"Security feature bypass in monkeytype","id":"CVE-2026-69183"},"products":["c-ares"],"published":"2026-09-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-21","vendors":["c-ares"]},"summary":"A malicious DNS server can cause CPU exhaustion and deny DNS resolution in c-ares by sending crafted responses with unbounded compression pointer chains.","url":"https://insights.sbomify.com/CVE-2026-69184/"}