Multiple security vulnerabilities have been identified in c-ares, the asynchronous name resolution library used by Ubuntu. The issues affect c-ares on Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 26.04 LTS, with some flaws limited to older releases. They can allow a remote attacker to cause crashes, excessive resource consumption, or arbitrary code execution. The overall risk is service disruption and potential compromise of systems relying on asynchronous DNS resolution.
CVE-2020-22217: c-ares incorrectly parsed certain SOA replies in the asynchronous name resolution library. A remote attacker could exploit this flaw to crash c-ares and cause a denial of service, affecting only Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in c-ares, the asynchronous name resolution library used by Ubuntu. The issues affect c-ares on Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 26.04 LTS, with some flaws limited to older releases. They can allow a remote attacker to cause crashes, excessive resource consumption, or arbitrary code execution. The overall risk is service disruption and potential compromise of systems relying on asynchronous DNS resolution.
CVE-2020-22217: c-ares incorrectly parsed certain SOA replies in the asynchronous name resolution library. A remote attacker could exploit this flaw to crash c-ares and cause a denial of service, affecting only Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.[emaillocker id="1283"]
CVE-2022-4904: c-ares incorrectly handled certain sortlist strings. A remote attacker could exploit this flaw to crash c-ares, cause a denial of service, or execute arbitrary code, affecting only Ubuntu 16.04 LTS.
CVE-2026-69184: c-ares did not properly limit DNS compression pointer hops or assembled name lengths when parsing DNS names. A remote attacker could exploit this flaw to cause excessive resource consumption and a denial of service.
CVE-2026-69186: c-ares did not properly validate record count fields before allocating memory when parsing DNS responses. A remote attacker could exploit this flaw to cause excessive resource consumption and a denial of service, affecting only Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
These vulnerabilities collectively present a risk of denial of service and potential code execution in systems that use c-ares for asynchronous name resolution. The greatest exposure is for deployments that process untrusted DNS responses, particularly on affected older releases. Prompt attention to the affected components is warranted.
We recommend you to update c-ares to version 1.34.6-1ubuntu0.2, 1.27.0-1.0ubuntu1.1, 1.18.1-1ubuntu0.22.04.4, 1.15.0-1ubuntu0.5+esm1, 1.14.0-1ubuntu0.2+esm3 or 1.10.0-3ubuntu0.2+esm4 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]