SUSE-SU-2026:23364-1

This update for c-ares fixes the following issues:

Update to c-ares 1.34.8.

• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).
• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• c-ares 1.34.8:
  • For details, see https://c-ares.org/changelog.html.
• c-ares 1.34.6:
  • Ignore Windows IDN Search Domains until proper IDN support is added.
  • Various bug fixes.
• c-ares 1.34.4:
  • Changes:
    • QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938
  • Bugfixes:
    • Empty TXT records were not being preserved. PR #922
    • docs: update deprecation notices for ares_create_query() and ares_mkquery(). PR #910
    • license: some files weren't properly updated. PR #920
    • Fix bind local device regression from 1.34.0. PR #929, PR #931, PR #935
    • CMake: set policy version to prevent deprecation warnings. PR #932
    • CMake: shared and static library names should be the same on unix platforms like autotools uses. PR #933
    • Update to latest autoconf archive macros for enhanced system compatibility. PR #936
• c-ares 1.34.3:
  • Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906
  • Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911
  • TSAN warns on missing lock, but lock isn't actually necessary. PR #915
  • ares_getaddrinfo() for AF_UNSPEC should retry IPv4 if only IPv6 is received. 765d558
  • ares_send() shouldn't return ARES_EBADRESP, its ARES_EBADQUERY. 91519e7
  • Fix typos in man pages. PR #905
• c-ares 1.34.2:
  • Features:
    • adig: read arguments from adigrc. [PR #856]
    • Add new pending write callback optimization via ares_set_pending_write_cb. [PR #857]
    • New function ares_process_fds(). [PR #875]
    • Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]
    • adig: rework command line arguments to mimic dig from bind. [PR #890]
    • Add new method for overriding network functions ares_set_socket_function_ex() to properly support all new functionality. [PR #894]
    • Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]
    • ares_socket: set IP_BIND_ADDRESS_NO_PORT on ares_set_local_ip* tcp sockets [PR #887]
    • URI parser/writer for ares_set_servers_csv()/ares_get_servers_csv(). [PR #882]
    • Connection handling modularization. [PR #857], [PR #876]
    • Expose library/utility functions to tools. [PR #860]
    • Remove ares__ prefix, just use ares_ for internal functions. [PR #872]
    • fix: potential WIN32_LEAN_AND_MEAN redefinition. [PR #869]
    • Fix googletest v1.15 compatibility. [PR #874]
    • Fix pkgconfig thread dependencies. [PR #884]
• c-ares 1.33.0:
  • Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]
  • Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]
  • Reorganize source tree. [PR #822]
  • Refactoring of connection handling to prevent code duplication. [PR #839]
  • New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]
  • ares_destroy() race condition during shutdown due to missing lock. [PR #831]
• c-ares in 1.32:
  • Add support for DNS 0x20 to help prevent cache poisoning attacks, enabled by specifying ARES_FLAG_DNS0x20. Disabled by default. [PR #800]
  • Rework query timeout logic to automatically adjust timeouts based on network conditions. The timeout specified now is only used as a hint until there is enough history to calculate a more valid timeout. [PR #794]
  • DNS RR TXT strings should not be automatically concatenated as there are use cases outside of RFC 7208. In order to maintain ABI compliance, the ability to retrieve TXT strings concatenated is retained as well as a new API to retrieve the individual strings. This restores behavior from c-ares 1.20.0. [PR #801]
  • Clean up header inclusion logic to make hacking on code easier. [PR #797]
  • GCC/Clang: Enable even more strict warnings to catch more coding flaws. [253bdee]
  • Tests: Fix thread race condition in test cases for EventThread. [PR #803]
  • Thread Saftey: ares_timeout() was missing lock. [74a64e4]
• c-ares 1.31.0:
  • Enable Query Cache by default. [PR #786]
  • Enhance Windows DNS configuration change detection to also detect manual DNS configuration changes. [PR #785]
  • Various legacy MacOS Build fixes. [Issue #782]
  • Ndots value of zero in resolv.conf was not being honored. [852a60a]
  • Watt-32 build support had been broken for some time. [PR #781]
  • Distribute ares_dns_rec_type_tostr manpage. [PR #778]
• c-ares 1.30.0:
  • Basic support for SIG RR record (RFC 2931 / RFC 2535) [PR #773]
  • Validation that DNS strings can only consist of printable ascii characters otherwise will trigger a parse failure. [75de16c] and [40fb125]
  • QueryCache: Fix issue where purging on server changes wasn't working. [a6c8fe6]
• c-ares 1.29.0:
  • When using ARES_OPT_EVENT_THREAD, automatically reload system configuration when network conditions change. [PR #759]
  • Apple: reimplement DNS configuration reading to more accurately pull DNS settings. [PR #750]
  • Add observability into DNS server health via a server state callback, invoked whenever a query finishes. [PR #744]
  • Add server failover retry behavior, where failed servers are retried with small probability after a minimum delay. [PR #731]
  • Mark ares_channel_t * as const in more places in the public API. [PR #758]
  • Due to a logic flaw, dns name compression writing was not properly implemented which would result in the name prefix not being written for a partial match. This could cause issues in various record types such as MX records when using the deprecated API. Regression introduced in 1.28.0. [Issue #757]
  • Revert OpenBSD SOCK_DNS flag, it doesn't do what the docs say it does and causes c-ares to become non-functional. [PR #754]
  • ares_getnameinfo(): loosen validation on salen parameter. [Issue #752]
  • cmake: Android requires C99. [PR #748]
  • ares_queue_wait_empty() does not honor timeout_ms >= 0. [Issue #742]
• c-ares 1.28.1:
  • Emit warnings when deprecated c-ares functions are used. This can be disabled by passing a compiler definition of CARES_NO_DEPRECATED. [PR #732]
  • Add function ares_search_dnsrec() to search for records using the new DNS record data structures. [PR #719]
  • Rework internals to pass around ares_dns_record_t instead of binary data, this introduces new public functions of ares_query_dnsrec() and ares_send_dnsrec(). [PR #730]
  • tests: when performing simulated queries, reduce timeouts to make tests run faster.
  • Replace configuration file parsers with memory-safe parser. [PR #725]
  • Remove acountry completely, the manpage might still get installed otherwise. [Issue #718]
  • CMake: don't overwrite global required libraries/definitions/includes which could cause build errors for projects chain building c-ares. [Issue #729]
  • On some platforms, netinet6/in6.h is not included by netinet/in.h and needs to be included separately. [PR #728]
  • Fix a potential memory leak in ares_init(). [Issue #724]
  • Some platforms don't have the isascii() function. Implement as a macro. [PR #721]
  • CMake: Fix chain building if CMAKE runtime paths not set.
  • NDots configuration should allow a value of zero. [PR #735]