Skip to content
OpenAdvisories
High RLSA-2023:3584 1 CVE

Important: c-ares security update

Published Jun 24, 2023 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

* c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 c-ares 0:1.13.0-6.el8_8.2

Vulnerabilities 1

  • High 7.5
    CVE-2023-32067

    0-byte UDP payload DoS in c-ares

    c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously i…

    c-ares c-ares nodejs nodejs18 Debian Ubuntu Azure Linux Wolfi

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2209502