It was discovered that c-ares incorrectly parsed certain SOA replies. Aremote attacker could possibly use this issue to cause c-ares to crash,resulting in a denial of service. This issue only affected Ubuntu 16.04 LTSand Ubuntu 18.04 LTS. (CVE-2020-22217)It was discovered that c-ares incorrectly handled certain sortlist strings.A remote attacker could possibly use this issue to cause c-ares to crash,resulting in a denial of service, or execute arbitrary code. This issueonly affected Ubuntu 16.04 LTS. (CVE-2022-4904)It was discovered that c-ares did not properly limit DNS compressionpointer hops or assembled name lengths when parsing DNS names. A remoteattacker could possibly use this issue to cause c-ares to use excessiveresources, resulting in a denial of service. (CVE-2026-69184)It was discovered that c-ares did not properly validate record count fieldsbefore allocating memory when parsing DNS responses. A remote attackercould possibly use this issue to cause c-ares to use excessive resources,resulting in a denial of service. This issue only affected Ubuntu 24.04 LTSand Ubuntu 26.04 LTS. (CVE-2026-69186)