USN-8951-1: Ubuntu patches four DoS vulnerabilities in c-ares, the DNS library for Node.js and curl

Canonical released advisory USN-8951-1 on 21 October 2026, providing patches for four vulnerabilities in the c-ares library, used for asynchronous DNS name resolution. This matters to anyone managing VPS and Ubuntu servers because c-ares is not just a system resolver: it's the library that Node.js uses for dns.resolve4(), dns.resolve6() and other resolve*() calls, and that curl supports as an asynchronous resolution backend alongside the native resolver via threading. If you've compiled curl with --enable-ares or run Node.js services that resolve many names in parallel, this library sits in your critical path.

The four vulnerabilities

According to the official advisory, the corrected issues are:

CVE	Issue	Affected Releases
CVE-2020-22217	c-ares incorrectly parsed certain SOA replies, causing possible crash and denial of service	16.04 and 18.04 LTS only
CVE-2022-4904	incorrect handling of certain sortlist strings, with possible crash or arbitrary code execution	16.04 LTS only
CVE-2026-69184	missing limits on DNS compression jumps or assembled name lengths, leading to excessive resource consumption	All releases
CVE-2026-69186	missing validation of record count fields before memory allocation, leading to excessive resource consumption	24.04 and 26.04 LTS only

The two more recent vulnerabilities are the ones affecting modern installations: they strike during DNS response parsing and can lead to denial of service through resource exhaustion, not remote code execution.

Patched versions and how to update

The official advisory lists these package versions as fixes:

Release	Package	Version
26.04 LTS (resolute)	libcares2	1.34.6-1ubuntu0.2
24.04 LTS (noble)	libcares2	1.27.0-1.0ubuntu1.1
22.04 LTS (jammy)	libc-ares2	1.18.1-1ubuntu0.22.04.4
20.04 LTS (focal)	libc-ares2	1.15.0-1ubuntu0.5+esm1 (requires Ubuntu Pro)
18.04 LTS (bionic)	libc-ares2	1.14.0-1ubuntu0.2+esm3 (requires Ubuntu Pro)
16.04 LTS (xenial)	libc-ares2	1.10.0-3ubuntu0.2+esm4 (requires Ubuntu Pro via Legacy Support)

For those managing 20.04 and earlier releases without a Pro subscription, the patch is not available in standard repositories. On 22.04, 24.04 and 26.04, the usual apt update && apt upgrade suffices. After updating, it's worth restarting services that link to libcares2, not just the system: already-running processes keep the old library in memory until they are reloaded.