Ubuntu advisory USN-8951-1 covers c-ares DNS flaws that lead to denial of service

What happened and what to do

Ubuntu's advisory USN-8951-1, published on 21 October 2026, describes four flaws in c-ares. Parsing of SOA responses can make the library fail (CVE-2020-22217, affecting Ubuntu 16.04 and 18.04 LTS). Handling of sortlist strings can cause denial of service or arbitrary code execution (CVE-2022-4904, Ubuntu 16.04 LTS only). The DNS name parser does not limit the number of compression pointer hops or the length of assembled names (CVE-2026-69184). Record count fields are not validated before memory is allocated (CVE-2026-69186, Ubuntu 24.04 and 26.04 LTS only). In both 2026 cases, excessive resource consumption leads to denial of service.

For a company, the first step is inventory: identify which hosts, containers and images have c-ares installed, at which package version, and separate the affected LTS releases. Then apply the vendor updates and restart the services that depend on the library. Where the fix does not fit the maintenance window, the resolution layer can be hardened with resource limits, monitoring of latency and resolver errors, and fuzz testing of the DNS parser in internal components. A dashboard showing the version and patch status of each host gives the security team continuous visibility, not just a one-off response.

How the consultancy can help

Wendelmaques can diagnose where c-ares runs in your infrastructure, measure your exposure to these flaws and propose a staged remediation plan. It can also implement, on your own infrastructure, an inventory and DNS resolution monitoring dashboard with alerts, and operate it continuously.

Next step

If your team needs to assess this advisory, send a short description of your environment, including operating systems, services that use DNS and where the resolvers run, and receive a scoped proposal for diagnosis and implementation.