c-ares: bump to 1.34.8 - #30397
Conversation
openwrt-ai
left a comment
openwrt-ai
left a comment
There was a problem hiding this comment.
Reviewed 1 new commit. The bump itself is clean — hash verified against the published tarball, SONAME unchanged, no patches to refresh, CI green. One question inline about the CVE IDs quoted in the commit message; nothing here blocks a merge.
Generated by Claude Code
|
Thanks for catching this. You're right — I can't find an upstream source for CVE-2026-69184 or CVE-2026-69186 either. I'll replace those two IDs with GHSA-pjmc-gx33-gc76 and GHSA-jv8r-gqr9-68wj, respectively, and update the commit message accordingly. Also tagging @BKPepe since you merged the previous c-ares update in #28085. Could you please take a look at this PR as well? |
Update c-ares from 1.34.6 to 1.34.8. Version 1.34.7 includes the following security fixes: * CVE-2026-33630 (GHSA-6wfj-rwm7-3542): fix a use-after-free / double-free issue in query-completion handling. * CVE-2026-69184 (GHSA-pjmc-gx33-gc76): limit DNS name compression pointer traversal to prevent CPU-exhaustion denial of service. * CVE-2026-69186 (GHSA-jv8r-gqr9-68wj): validate DNS record counts before allocation to prevent memory-amplification denial of service. It also fixes the UDP socket exhaustion regression introduced in 1.34.6. Version 1.34.8 reverts an unintended API break introduced in 1.34.7 by the callback parameter const changes. Signed-off-by: Karen Khachatryan <karen0734@gmail.com>
openwrt-ai
left a comment
openwrt-ai
left a comment
There was a problem hiding this comment.
Reviewed 1 new commit; no new issues found.
The force-push left libs/c-ares/Makefile byte-identical to the version I reviewed at b8eebfb (git diff b8eebfb..1d1cc1a is empty) — only the commit message changed, and it now correctly attributes the security fixes to 1.34.7 while describing 1.34.8 as the revert of the const callback-parameter API break. That resolves the wording point from my last review, and the CVE-ID question is answered in the thread above. All 14 checks are green on 1d1cc1a.
Generated by Claude Code
2 participants
Update c-ares from 1.34.6 to 1.34.8.
The update includes the security fixes released in 1.34.7:
Version 1.34.7 also fixes the UDP socket exhaustion regression introduced in 1.34.6.
Version 1.34.8 reverts the callback parameter const changes introduced in 1.34.7, which caused an unintended API break.
📦 Package Details
Maintainer: @karlp
🧪 Run Testing Details
I have also been running c-ares 1.34.8 in regular use on OpenWrt with
https-dns-proxyand have not observed any issues.The package I have been using is available here:
https://github.com/karen07/c-ares-openwrt-package