From: Karen Khachatryan <redacted>
Date: Sun, 30 Aug 2026 09:44:14 +0000 (+0300)
Subject: c-ares: bump to 1.34.8
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=f3bc744d83800d067674e0c85bc00c6ae114e319;p=openwrt-packages.git

c-ares: bump to 1.34.8

Update c-ares from 1.34.6 to 1.34.8.

Version 1.34.7 includes the following security fixes:

* CVE-2026-33630 (GHSA-6wfj-rwm7-3542): fix a use-after-free /
  double-free issue in query-completion handling.
* CVE-2026-69184 (GHSA-pjmc-gx33-gc76): limit DNS name compression
  pointer traversal to prevent CPU-exhaustion denial of service.
* CVE-2026-69186 (GHSA-jv8r-gqr9-68wj): validate DNS record counts
  before allocation to prevent memory-amplification denial of service.

It also fixes the UDP socket exhaustion regression introduced in 1.34.6.

Version 1.34.8 reverts an unintended API break introduced in 1.34.7 by
the callback parameter const changes.

Signed-off-by: Karen Khachatryan <redacted>
---

diff --git a/libs/c-ares/Makefile b/libs/c-ares/Makefile
index af548eacd..1cc439d44 100644
--- a/libs/c-ares/Makefile
+++ b/libs/c-ares/Makefile
@@ -9,12 +9,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=c-ares
-PKG_VERSION:=1.34.6
+PKG_VERSION:=1.34.8
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/c-ares/c-ares/releases/download/v$(PKG_VERSION)
-PKG_HASH:=912dd7cc3b3e8a79c52fd7fb9c0f4ecf0aaa73e45efda880266a2d6e26b84ef5
+PKG_HASH:=c222b6d681096f9444d2c4863d2c1174019e27cacca0a4a5c114d36dd7d7bf78
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE.md