Ubuntu Releases Security Fixes for c-ares DNS Library Vulnerabilities
Multiple high-severity flaws in the c-ares library could lead to denial of service or arbitrary code execution. Affects several Ubuntu LTS versions.
TL;DR
- Four vulnerabilities found in c-ares DNS parsing library used by Ubuntu.
- Issues range from denial of service to potential remote code execution.
- Affects Ubuntu 16.04, 18.04, 24.04, and 26.04 LTS versions.
- Patches address improper input validation and resource exhaustion risks.
- Organizations using affected Ubuntu versions should update immediately.
Ubuntu has published security updates addressing critical vulnerabilities in the c-ares asynchronous DNS resolver library. These flaws affect multiple long-term support releases and could be exploited remotely to cause service disruptions or, in some cases, execute arbitrary code.
The c-ares library is widely used in network applications requiring non-blocking DNS resolution. The identified issues stem from inadequate validation of DNS response data and improper handling of specific query types, potentially allowing attackers to crash services or consume excessive system resources.
Organizations running affected Ubuntu versions should prioritize applying these updates to protect against possible exploitation through malformed DNS traffic.
Denial of Service Risks Across Ubuntu Versions
- CVE-2020-22217 affects Ubuntu 16.04 and 18.04 through incorrect parsing of SOA DNS records.
- CVE-2026-69184 impacts all supported Ubuntu versions due to unchecked DNS compression pointer loops.
- CVE-2026-69186 specifically targets Ubuntu 24.04 and 26.04 with memory allocation flaws during DNS parsing.
- Successful exploitation leads to service crashes or resource exhaustion without authentication.
Remote Code Execution and Mitigation Steps
- CVE-2022-4904 allows potential arbitrary code execution on Ubuntu 16.04 via malformed sortlist entries.
- All vulnerabilities can be triggered remotely without user interaction through crafted DNS responses.
- Administrators should upgrade packages using standard Ubuntu update mechanisms immediately.
- Applications embedding c-ares should also verify they're using patched versions beyond Ubuntu's built-in updates.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.