Description
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
c-ares c-ares
< 1.34.7affected
References
- https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76 ↗
- https://github.com/c-ares/c-ares/pull/1164 ↗
- https://github.com/c-ares/c-ares/pull/1210 ↗
- https://github.com/c-ares/c-ares/commit/5c8341ba6ff3a8e4e4dfd616f8ed0418838b8b7b ↗
- https://github.com/c-ares/c-ares/commit/f1288bbc70e9a1e0a77134c2382157e52d326aea ↗
- https://github.com/c-ares/c-ares/releases/tag/v1.34.7 ↗