Skip to content
OpenAdvisories
High USN-7477-1 1 CVE

c-ares vulnerability

Published May 5, 2025 · Updated Oct 13, 2025

Ecosystem: Ubuntu

Summary

It was discovered that c-ares incorrectly handled re-enqueuing certain
queries. A remote attacker could possibly use this issue to cause c-ares to
crash, resulting in a denial of service.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 25.04 c-ares 1.34.4-2.1ubuntu0.1

Vulnerabilities 1

  • High 8.3
    CVE-2025-31498

    c-ares has a use-after-free in read_answers()

    c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or …

    c-ares c-ares fluent-bit c-ares Debian Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2025-31498