Cyber ·
Ubuntu publishes notice USN-8951-1 for c-ares vulnerabilities
Ubuntu published notice USN-8951-1 covering four flaws in the c-ares library, used for asynchronous DNS resolution. The issues can cause denial of service and, in one case, arbitrary code execution on specific versions.
On 21 October 2026, Ubuntu published notice USN-8951-1, covering vulnerabilities in the c-ares library, which is used for DNS name resolution. According to the text received from the Ubuntu Security feed, the flaws can lead to denial of service and, in one case, to arbitrary code execution. The text indicates that fixes were made available for the affected versions.
The notice describes four problems. CVE-2020-22217 involves incorrect parsing of certain SOA responses and affected only Ubuntu 16.04 LTS and 18.04 LTS. CVE-2022-4904 involves incorrect handling of sortlist strings, with possible crash or code execution, and affected only Ubuntu 16.04 LTS. CVE-2026-69184 involves failure to properly limit the number of DNS compression pointer jumps and the length of assembled names, which can consume excessive resources. CVE-2026-69186 involves failure to validate record count fields before allocating memory, also risking excessive resource use and denial of service, and affected only Ubuntu 24.04 LTS and 26.04 LTS.
The relevance for system operators is to check whether machines with c-ares installed run the listed versions and apply the updates indicated in the official notice. Rota Nacional does not patch operating system libraries and does not replace that process. To consult and verify, use the original Ubuntu notice under the identifier USN-8951-1 and check the list of packages and fixed versions.