Philipp Jeitner and Haya Shulman discovered a flaw in libc-ares2, a library that performs DNS requests and name resolution asynchronously. Missing input validation of hostnames returned by DNS servers can lead to output of wrong hostnames .