Skip to content
OpenAdvisories
High ALSA-2023:3584 1 CVE

Important: c-ares security update

Published Jun 14, 2023 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

* c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 8 c-ares 1.13.0-6.el8_8.2
AlmaLinux · 8 c-ares-devel 1.13.0-6.el8_8.2

Vulnerabilities 1

  • High 7.5
    CVE-2023-32067

    0-byte UDP payload DoS in c-ares

    c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously i…

    c-ares c-ares nodejs nodejs18 Debian Ubuntu Azure Linux Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-32067
  • report
    https://bugzilla.redhat.com/2209502
  • advisory
    https://errata.almalinux.org/8/ALSA-2023-3584.html