Ubuntu fixes four c-ares DNS library vulnerabilities across all supported releases

Brief written by the FOSSWire AI editor from Ubuntu How we write

October 21, 2026 1 min read

Key Takeaway

Ubuntu patched four security vulnerabilities in the c-ares asynchronous DNS resolution library, with some flaws dating back to 2020 and others affecting only the newest LTS releases.

Summary

Canonical issued USN-8951-1 addressing four CVEs in c-ares, a widely used C library for asynchronous DNS requests. The flaws range from denial-of-service via malformed SOA replies and sortlist strings to resource exhaustion through unbounded DNS compression pointer hops and unvalidated record count fields. Affected releases span Ubuntu 16.04 LTS through 26.04 LTS, with two older CVEs limited to ESM-supported releases and two newer ones hitting 24.04 LTS and 26.04 LTS.

Which releases and CVEs are affected

CVE-2020-22217: SOA reply parsing flaw causing crashes; affects Ubuntu 16.04 LTS and 18.04 LTS only
CVE-2022-4904: sortlist string handling bug permitting crashes or arbitrary code execution; Ubuntu 16.04 LTS only
CVE-2026-69184: missing limits on DNS compression pointer hops and assembled name lengths leading to resource exhaustion; all supported releases
CVE-2026-69186: unvalidated record count fields before memory allocation causing resource exhaustion; Ubuntu 24.04 LTS and 26.04 LTS only
Fixed package versions: libcares2 1.34.6-1ubuntu0.2 (26.04), 1.27.0-1.0ubuntu1.1 (24.04); libc-ares2 1.18.1-1ubuntu0.22.04.4 (22.04), 1.15.0-1ubuntu0.5+esm1 (20.04), 1.14.0-1ubuntu0.2+esm3 (18.04), 1.10.0-3ubuntu0.2+esm4 (16.04)

Why it matters

c-ares is embedded in numerous applications including Node.js, cURL, and various network tools; the patch coverage across all supported Ubuntu releases, including ESM-extended older LTS versions, reduces exposure for long-tail infrastructure still running 16.04 and 18.04.

Original reference: ubuntu.com →