Ubuntu USN-8951-1 Fixes c-ares DNS Parsing Flaws
Tech GuruQuick Answer
Ubuntu USN-8951-1 fixes four c-ares vulnerabilities across Ubuntu 16.04 ESM through 26.04 LTS. Match CVE scope by release, install the listed package, restart long-running resolver consumers, validate DNS behavior, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory c-ares libraries and dependent services, Ubuntu releases, package versions, DNS exposure, owners, and ESM entitlements; match release-specific CVE scope; install the USN package; restart consumers; test resolution and failure handling; and retain evidence.
Last verified: 2026-10-22 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | c-ares asynchronous DNS resolver packages on Ubuntu 16.04 ESM through 26.04 LTS |
|---|---|
| Advisory | USN-8951-1 |
| CVEs | CVE-2020-22217, CVE-2022-4904, CVE-2026-69184, CVE-2026-69186 |
| Authoritative release date | 2026-10-21 18:20:42.696337 UTC |
| Authority revision date | 2026-10-21 18:20:42.696337 UTC |
| Affected versions | The Ubuntu releases and c-ares builds listed in USN-8951-1; CVE applicability differs by release, with the arbitrary-code issue limited by Ubuntu to 16.04 LTS. |
| Fixed version | bionic: c-ares 1.14.0-1ubuntu0.2+esm3; focal: c-ares 1.15.0-1ubuntu0.5+esm1; jammy: c-ares 1.18.1-1ubuntu0.22.04.4; noble: c-ares 1.27.0-1.0ubuntu1.1; resolute: c-ares 1.34.6-1ubuntu0.2; xenial: c-ares 1.10.0-3ubuntu0.2+esm4 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Ubuntu does not state that this issue is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Ubuntu fixed four c-ares issues in DNS response and sortlist parsing. The authority describes denial-of-service paths across affected releases and possible arbitrary code execution for CVE-2022-4904 on Ubuntu 16.04 LTS.
What To Validate Now
- Inventory. Identify c-ares asynchronous DNS resolver packages on Ubuntu 16.04 ESM through 26.04 LTS, exact Ubuntu release and package version, workload or service dependencies, exposure, owner, and maintenance constraints.
- Establish applicability. Match each host to USN-8951-1 and its release-specific package scope. The Ubuntu releases and c-ares builds listed in USN-8951-1; CVE applicability differs by release, with the arbitrary-code issue limited by Ubuntu to 16.04 LTS. Do not infer applicability from the package family alone.
- Remediate. Install the advisory-listed package through the supported Ubuntu or Ubuntu Pro channel, then restart or reload dependent services when required by normal operations.
- Validate. Confirm the installed package version and active process state, exercise representative dependent workflows, monitor for regressions, and retain package, change, restart, and validation evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
CVE applicability varies by Ubuntu release. Ubuntu limits the arbitrary-code condition to 16.04 LTS and describes the other issues primarily as resource exhaustion or crashes; avoid applying one impact statement to every release.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
