Resource exhaustion in c-ares - #VU137035

Detailed vulnerability description

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the DNS response parser when parsing DNS responses. A remote attacker can send a specially crafted DNS response with forged header record counts to cause a denial of service.

The issue is triggered before transaction-ID validation or question matching, and sustained exploitation is required to produce allocator pressure that degrades availability.

Remediation

Sources

• https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj
• https://github.com/c-ares/c-ares/commit/e47c203f91cd8b749c8736bc18d75a31ffdec8f4