Critical Vulnerability in c-ares Library Allows DoS and Code Execution

• •c-ares library vulnerability could lead to DoS or arbitrary code execution.
• •Affected systems include Ubuntu 26.04 LTS with specific package versions.
• •Users are urged to update their systems to mitigate risks.

A vulnerability in the c-ares library, which is used for asynchronous name resolution, has been identified. This flaw allows attackers to exploit specially crafted network traffic, potentially leading to denial of service or arbitrary code execution. The issue arises from improper handling of query completion callbacks, which could result in use-after-free or double-free conditions. Affected systems include Ubuntu 26.04 LTS, specifically the libcares2 package version 1.34.6-1ubuntu0.1. Users are advised to update their systems to mitigate the risk. Both Ubuntu and Linux Security have issued advisories on this matter, highlighting the urgency of applying the necessary patches. The vulnerability has not yet been confirmed as actively exploited in the wild.