Skip to main content

DNS Implementation CVE-2026-69184

MEDIUM
2026-08-13 vendor:ubuntu
Share

Severity by source

vuln.today AI
5.9 MEDIUM

Network vector (DNS response delivery), high complexity (attacker must control DNS response path), no privileges or user interaction needed, availability-only impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

1
Analysis Generated
Aug 14, 2026 - 19:09 vuln.today

DescriptionCVE.org

[GHSA-pjmc-gx33-gc76: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains]

AnalysisAI

CPU-exhaustion denial of service affects DNS name parsing logic in packages tracked by Ubuntu, exploitable via crafted DNS messages containing unbounded compression pointer chains (GHSA-pjmc-gx33-gc76). An attacker who can send DNS responses or queries to an affected resolver or client library can cause the parser to follow circular or deeply nested compression pointers indefinitely, consuming CPU until the process becomes unresponsive. No CVSS vector, CWE, or KEV status has been assigned at time of analysis; no public exploit is confirmed.

Technical ContextAI

DNS name compression (RFC 1035 §4.1.4) allows message-internal pointers to reduce redundancy - a name component may point to an earlier offset rather than repeating the label. A compliant parser must follow these pointers to reconstruct the full domain name. If a crafted message contains a chain of pointers that cycles back on itself or grows without bound, a naive parser will loop or recurse indefinitely rather than detecting the cycle and aborting. This class of flaw typically falls under CWE-835 (Loop with Unreachable Exit Condition) or CWE-400 (Uncontrolled Resource Consumption), though neither CWE is confirmed in the input data. The Ubuntu vendor report suggests the affected code is present in a packaged open-source DNS library or resolver distributed through Ubuntu repositories. No CPE strings were provided, so exact product and version scope cannot be confirmed from available data alone.

Affected ProductsAI

The affected product is a DNS-related library or resolver package distributed through Ubuntu repositories, identified by GHSA-pjmc-gx33-gc76. No CPE strings, specific package names, or version ranges were included in the provided intelligence data. The Ubuntu vendor attribution ('vendor:ubuntu') confirms Ubuntu has assessed or reported this issue, but the exact source package and affected Ubuntu release series are not specified in the available data. Consumers should monitor Ubuntu Security Notices (USN) for the authoritative affected-package list.

RemediationAI

No patch version or vendor advisory URL was provided in the available intelligence. Consumers should monitor Ubuntu Security Notices at ubuntu.com/security/notices and the GitHub Security Advisory GHSA-pjmc-gx33-gc76 for patch availability and exact fix versions. As a compensating control while awaiting a patch, operators can apply rate limiting or maximum-depth enforcement on DNS pointer chain traversal at the application or firewall layer, or restrict which DNS servers the affected software may query to trusted, controlled resolvers - this limits the attacker's ability to deliver crafted responses but does not eliminate risk if the attacker controls an upstream resolver. Note that pointer-chain depth limits may cause legitimate but unusual DNS responses to fail; test in non-production before broad deployment.

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed
SUSE Linux Micro 6.0 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed

Share

CVE-2026-69184 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy