Is there a patch available for CVE-2026-69186?

Yes, a patch is available for CVE-2026-69186. Update the affected software to the latest version immediately.

DNS Parser (Ubuntu) CVE-2026-69186

MEDIUM

2026-08-13 vendor:ubuntu

Severity by source

vuln.today AI

7.5 HIGH

Network-reachable DNS parser, no authentication required to send packets, availability-only impact via memory exhaustion; no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from SUSE.

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 19:08 vuln.today

CVE Published

Aug 13, 2026 - 00:00 cve.org

MEDIUM

DescriptionCVE.org

[GHSA-jv8r-gqr9-68wj: Memory-amplification denial of service via unvalidated DNS header record counts]

AnalysisAI

Memory-amplification denial of service in a DNS parsing component reported via Ubuntu affects systems that process DNS messages with unvalidated header record counts. An attacker who can send crafted DNS packets can cause the affected parser to allocate memory proportional to attacker-controlled count fields, exhausting available memory and crashing the service. No CVSS score, KEV listing, or public exploit has been confirmed for this CVE at time of analysis.

Technical ContextAI

DNS message headers contain count fields (QDCOUNT, ANCOUNT, NSCOUNT, ARCOUNT) that indicate how many records follow in each section. A parser that allocates buffers or data structures based on these counts before validating that the corresponding records actually exist in the packet is vulnerable to memory amplification: a small crafted packet with a large forged count can trigger allocation of arbitrarily large memory regions. The CWE is not specified in the provided data, but the root cause class is consistent with CWE-789 (Uncontrolled Memory Allocation) or CWE-400 (Uncontrolled Resource Consumption). The issue was disclosed via GitHub Security Advisory GHSA-jv8r-gqr9-68wj and reported through Ubuntu's vendor channel.

Affected ProductsAI

The affected product is identified via Ubuntu's vendor report tied to GHSA-jv8r-gqr9-68wj. The specific DNS library or package name within Ubuntu is not named in the provided data, nor are affected version ranges or CPE strings available. Operators should consult the Ubuntu Security Notices (USN) portal and the GitHub Security Advisory GHSA-jv8r-gqr9-68wj for authoritative package and version information.

RemediationAI

Consult the Ubuntu Security Notices portal for the specific package affected by CVE-2026-69186 and apply the vendor-released patch once available. No exact fix version is confirmed in the provided data - patch availability should be verified directly against the Ubuntu security tracker (ubuntu.com/security/CVE-2026-69186) and GHSA-jv8r-gqr9-68wj. If a patch is not yet available, compensating controls include: restricting DNS query ingress to trusted sources via firewall rules (blocks unauthenticated external exploitation); enabling rate limiting on DNS listeners to reduce amplification throughput; and monitoring for anomalous memory consumption on DNS-handling processes. Rate limiting may degrade legitimate resolver performance under load.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Micro 6.0	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

CVE-2026-69186 vulnerability details – vuln.today

Back