[RELEASE] c-ares-1.34.9 (security release)

[Brad House]

Hello,

c-ares 1.34.9 is now available. This is a security release that fixes 11
vulnerabilities (1 high, 9 medium, 1 low). All users are encouraged to
upgrade.

Download:
   https://c-ares.org/download/
   https://github.com/c-ares/c-ares/releases/tag/v1.34.9

   c-ares-1.34.9.tar.gz
   SHA-256: 9364b70a12eb59a06830fb488d9357f90100dff0d98b23ea3593a183d43e6f2f
   Signed by Brad House, key DA7D64E4C82C6294CB73A20E22E3D13B5411B7CA
   (c-ares-1.34.9.tar.gz.asc)

Note for applications that provide their own socket functions: UDP replies
must now come from the server's port as well as its address, so a custom
arecvfrom must fill in the full source address, including the port. See the
Changes section below.

c-ares version 1.34.9 - October 19 2026

This is a security release.

Security:
* Memory corruption when an application cancels its lookups after a
   connection failure. Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-wpr3-8q3r-4q8c
* A DNS reply that arrived from a different server than the one queried 
could
   be accepted. Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-fqh5-3x7m-wp44
* Use-after-free of a lookup after shutting down a failed connection. Please
   see 
https://github.com/c-ares/c-ares/security/advisories/GHSA-97vq-4mxv-7vhm
* Use-after-free when an application cancels lookups from a callback, or 
shuts
   a channel down. Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-rf6g-ww74-97qh
* Use-after-free of a connection after the socket-state callback returns.
   Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-mw23-pfg6-2x9r
* Use-after-free when an application cancels lookups from a server-state
   callback. Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-v33j-65h4-4ch8
* Use-after-free of a server record when an application changes its DNS
   servers from a callback. Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-pj7p-v3cw-hq66
* Use-after-free of a cached DNS answer while the application is still 
reading
   it. Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-grv7-fq5q-9vfc
* Buffer overflow when `ares_dup()` or `ares_save_options()` runs while
   another thread changes the servers. Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-ph6c-3cvx-mq6v
* Uninitialized memory returned for a numeric IPv6 name with a prefix 
length.
   Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-cfcv-8v2j-qj6r
* The query cache could return an answer obtained using different EDNS
   options. Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-wrgc-prmw-27xh

Changes:
* Answers served from the query cache now report their remaining TTL rather
   than the TTL originally received.
* `ares_inet_pton()` rejects a "/bits" prefix length and returns 0, rather
   than -1, for any input it cannot parse.
* UDP replies must now come from the server's port as well as its address.
   Custom `arecvfrom` socket functions (`ares_set_socket_functions_ex()` or
   `ares_set_socket_functions()`) must fill in the full source address,
   including the port. For compatibility, a reported port of 0 checks 
only the
   address, but such implementations are insecure and should be fixed.
   https://github.com/c-ares/c-ares/pull/1370
* Document that socket functions and socket, configure and pending-write
   callbacks must not call c-ares functions on the same channel.
   https://github.com/c-ares/c-ares/pull/1360

Bugfixes:
* `ares_dup()`: don't leave the new channel bound to the source channel.
   https://github.com/c-ares/c-ares/pull/1333
* `ares_init_options()`: don't report the default query cache as a 
caller-set
   option. https://github.com/c-ares/c-ares/pull/1354
* Clamp DNS record TTLs to the signed int range used by public APIs.
   https://github.com/c-ares/c-ares/pull/1313
* `ares_dns_write()`: reject messages larger than 64KB.
   https://github.com/c-ares/c-ares/pull/1314
* `ares_dns_parse()`: accept legacy compressed RDATA names.
   https://github.com/c-ares/c-ares/pull/1326
* `ares_parse_a_reply()`/`ares_parse_aaaa_reply()`: ignore a negative
   `*naddrttls`. https://github.com/c-ares/c-ares/pull/1302
* select event backend: refuse descriptors >= `FD_SETSIZE` instead of
   overflowing `fd_set`. https://github.com/c-ares/c-ares/pull/1312
* Strip inline comments from resolv.conf values.
   https://github.com/c-ares/c-ares/pull/1276
* Ignore absurd resolv.conf retry/attempts values.
   https://github.com/c-ares/c-ares/pull/1315
* Zero-initialize the server config when parsing nameserver URIs.
   https://github.com/c-ares/c-ares/pull/1325
* URI parsing: roll back the ':' probe when it lands past the '@'.
   https://github.com/c-ares/c-ares/pull/1265
* Do not assume `gethostname()` NUL-terminates its buffer.
   https://github.com/c-ares/c-ares/pull/1269
* Combine the hash table seed with XOR instead of OR.
   https://github.com/c-ares/c-ares/pull/1330
* Turn off stdio buffering when loading a file.
   https://github.com/c-ares/c-ares/pull/939
* Guard `pipe2()` on Apple platforms to prevent unguarded availability
   warnings. https://github.com/c-ares/c-ares/pull/1328

Thanks go to these friendly people for their efforts and contributions 
for this
release:

* (@ahillspace)
* (@anon5376)
* Brad House (@bradh352)
* Nikolaos Chatzikonstantinou (@createyourpersonalaccount)
* Dev (@devdgna)
* (@evilgensec)
* Ilias (@iliasabk)
* (@jdymitarai)
* (@jmestwa-coder)
* Manohar Paturi (@ManoharPaturi)
* (@mardgez13)