Description
c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| c-ares | c-ares | < 1.27.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | c-ares | 1.27.0-1 | — |
| Debian 13 | c-ares | 1.27.0-1 | — |
| Debian 12 | c-ares | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | c-ares | 1.18.1-1ubuntu0.22.04.3 | USN-6676-1 |
| Ubuntu 20.04 LTS | c-ares | 1.15.0-1ubuntu0.5 | USN-6676-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | c-ares | 1.14.0-1ubuntu0.2+esm2 | USN-6676-1 |
| Ubuntu Pro 16.04 LTS | c-ares | 1.10.0-3ubuntu0.2+esm3 | USN-6676-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | c-ares +1 | 1.19.1-2.el9_4 | RHSA-2024:3842 |
| RHEL 9 | nodejs +3 | 1:16.20.2-8.el9_4 | RHSA-2024:2910, RHSA-2024:2853, RHSA-2024:2779 |
| RHEL 9 | nodejs-devel | 1:18.20.2-2.module+el9.4.0+21742+692df1ea | RHSA-2024:2853, RHSA-2024:2779 |
| RHEL 9 | nodejs-nodemon | 3.0.1-1.module+el9.3.0.z+20478+84a9f781 | RHSA-2024:2853, RHSA-2024:2779 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-4.module+el9.1.0+15718+e52ec601 | RHSA-2024:2853, RHSA-2024:2779 |
| RHEL 9 | npm | 1:8.19.4-1.16.20.2.8.el9_4 | RHSA-2024:2910, RHSA-2024:2853, RHSA-2024:2779 |
| RHEL 8 | c-ares +1 | 1.13.0-11.el8_10 | RHSA-2024:4249 |
| RHEL 8 | nodejs +3 | 1:18.20.2-1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780, RHSA-2024:2778 |
| RHEL 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+20473+c4e3d824 | RHSA-2024:2780, RHSA-2024:2778 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-4.module+el8.9.0+19519+e25b965a | RHSA-2024:2780, RHSA-2024:2778 |
| RHEL 8 | npm | 1:10.5.0-1.18.20.2.1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780, RHSA-2024:2778 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | nodejs +3 | 1:16.20.2-6.el9_2.3 | RHSA-2024:4559 |
| RHEL 9.2 EUS | npm | 1:8.19.4-1.16.20.2.6.el9_2.3 | RHSA-2024:4559 |
| RHEL 9.0 E4S | nodejs +3 | 1:16.20.2-9.el9_0 | RHSA-2024:4721 |
| RHEL 9.0 E4S | npm | 1:8.19.4-1.16.20.2.9.el9_0 | RHSA-2024:4721 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | c-ares +1 | 1.19.1-2.el9_4 | ALSA-2024:3842 |
| AlmaLinux 9 | nodejs +3 | 1:16.20.2-8.el9_4 | ALSA-2024:2910, ALSA-2024:2853, ALSA-2024:2779 |
| AlmaLinux 9 | nodejs-devel | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2853, ALSA-2024:2779 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.2.0+36+853e48f5 | ALSA-2024:2853, ALSA-2024:2779 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2024:2853, ALSA-2024:2779 |
| AlmaLinux 9 | npm | 1:8.19.4-1.16.20.2.8.el9_4 | ALSA-2024:2910, ALSA-2024:2853, ALSA-2024:2779 |
| AlmaLinux 8 | c-ares +1 | 1.13.0-11.el8_10 | ALSA-2024:4249 |
| AlmaLinux 8 | nodejs +3 | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780, ALSA-2024:2778 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2024:2780, ALSA-2024:2778 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780, ALSA-2024:2778 |
| AlmaLinux 8 | npm | 1:10.5.0-1.18.20.2.1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780, ALSA-2024:2778 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | c-ares | 1.19.1-2.el9_4 | RLSA-2024:3842 |
| Rocky Linux 9 | nodejs | 1:16.20.2-8.el9_4 | RLSA-2024:2910 |
| Rocky Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:2853, RLSA-2024:2779 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:2853, RLSA-2024:2779 |
| Rocky Linux 8 | c-ares | 1.13.0-11.el8_10 | RLSA-2024:4249 |
| Rocky Linux 8 | nodejs | 1:18.20.2-1.module+el8.9.0+1803+9ac8b495 | RLSA-2024:2780, RLSA-2024:2778 |
| Rocky Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:2780, RLSA-2024:2778 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:2780, RLSA-2024:2778 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES 15 SP6 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES 15 SP5 | c-ares | 1.19.1-150000.3.26.1 | SUSE-SU-2026:4021-1, SUSE-SU-2024:1136-1 |
| SLES 15 SP4 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES 12 SP5 | libcares2 | 1.9.1-9.21.1 | SUSE-SU-2024:1135-1 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES for SAP 15 SP5 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES for SAP 15 SP4 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES for SAP 12 SP5 | libcares2 | 1.9.1-9.21.1 | SUSE-SU-2024:1135-1 |
| SLE Micro 5.5 | c-ares | 1.19.1-150000.3.26.1 | SUSE-SU-2026:4021-1, SUSE-SU-2024:1136-2, SUSE-SU-2024:1136-1 |
| SLE Micro 5.4 | c-ares | 1.19.1-150000.3.26.1 | SUSE-SU-2026:4021-1, SUSE-SU-2024:1136-1 |
| SLE Micro 5.3 | c-ares | 1.19.1-150000.3.26.1 | SUSE-SU-2026:4021-1, SUSE-SU-2024:1136-1 |
| SLE Micro 5.2 | c-ares | 1.19.1-150000.3.26.1 | SUSE-SU-2024:1136-1 |
| SLE Micro 5.1 | c-ares | 1.19.1-150000.3.26.1 | SUSE-SU-2024:1136-1 |
| SLE HPC 15 SP5 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLE HPC 15 SP4 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | c-ares | 1.27.0-1.1 | openSUSE-SU-2024:13722-1 |
| openSUSE Leap 15.5 | c-ares | 1.19.1-150000.3.26.1 | SUSE-SU-2024:1136-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.4 | c-ares | 1.19.1-150000.3.26.1 | SUSE-SU-2024:1136-1 |
| openSUSE Leap Micro 5.3 | c-ares | 1.19.1-150000.3.26.1 | SUSE-SU-2024:1136-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | c-ares | 1.27.0-r0 | — |
| Alpine v3.23 | c-ares | 1.27.0-r0 | — |
| Alpine v3.22 | c-ares | 1.27.0-r0 | — |
| Alpine v3.21 | c-ares | 1.27.0-r0 | — |
| Alpine v3.20 | c-ares | 1.27.0-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | c-ares | 1.27.0-r0 | — |
| Alpine v3.18 | c-ares | 1.19.1-r1 | — |
| Alpine v3.17 | c-ares | 1.19.1-r1 | — |
| Alpine v3.16 | c-ares | 1.19.1-r1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | c-ares +1 | 1.19.0-1.amzn2023.0.1 | ALAS2023-2024-563 |
| Amazon Linux 2023 | nodejs +4 | 1:18.18.2-1.amzn2023.0.3 | ALAS2023-2024-568 |
| Amazon Linux 2023 | nodejs-npm | 1:9.8.1-1.18.18.2.1.amzn2023.0.3 | ALAS2023-2024-568 |
| Amazon Linux 2023 | nodejs20 +4 | 1:20.11.1-1.amzn2023.0.2 | ALAS2023-2024-562 |
| Amazon Linux 2023 | nodejs20-npm | 1:10.2.4-1.20.11.1.1.amzn2023.0.2 | ALAS2023-2024-562 |
| Amazon Linux 2023 | v8-10.2-devel | 3:10.2.154.26-1.18.18.2.1.amzn2023.0.3 | ALAS2023-2024-568 |
| Amazon Linux 2023 | v8-11.3-devel | 3:11.3.244.8-1.20.11.1.1.amzn2023.0.2 | ALAS2023-2024-562 |
| Amazon Linux 2 | c-ares +1 | 1.10.0-3.amzn2.0.6 | ALAS2-2024-2494 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | c-ares | 1.30.0-1 | — |
| Azure Linux 3 | ceph | 18.2.2-1 | — |
| Azure Linux 3 | fluent-bit | 3.0.6-1 | — |
| Azure Linux 3 | nodejs | 20.14.0-1 | — |
| Azure Linux 3 | python-gevent | 23.9.1-4 | — |
| Azure Linux 2 (CBL-Mariner) | c-ares | 1.19.1-2 | — |
| Azure Linux 2 (CBL-Mariner) | fluent-bit | 2.2.3-1 | — |
| Azure Linux 2 (CBL-Mariner) | grpc | 1.42.0-9 | — |
| Azure Linux 2 (CBL-Mariner) | nodejs18 | 18.20.2-1 | — |
| Azure Linux 2 (CBL-Mariner) | python-gevent | 21.1.2-3 | — |
| Azure Linux 2 (CBL-Mariner) | python-pycares | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | c-ares +1 | 1.19.1-2.el9_4 | ELSA-2024-3842 |
| Oracle Linux 9 | nodejs +3 | 1:16.20.2-8.0.1.el9_4 | ELSA-2024-2910, ELSA-2024-2853, ELSA-2024-2779 |
| Oracle Linux 9 | nodejs-devel | 1:18.20.2-1.module+el9.4.0+90321+c72a88c5 | ELSA-2024-2853, ELSA-2024-2779 |
| Oracle Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.3.0+90066+12d4a8d7 | ELSA-2024-2853, ELSA-2024-2779 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-4.module+el9.1.0+20762+f52d7401 | ELSA-2024-2853, ELSA-2024-2779 |
| Oracle Linux 9 | npm | 1:8.19.4-1.16.20.2.8.0.1.el9_4 | ELSA-2024-2910, ELSA-2024-2853, ELSA-2024-2779 |
| Oracle Linux 8 | c-ares +1 | 1.13.0-11.el8_10 | ELSA-2024-4249 |
| Oracle Linux 8 | nodejs +3 | 1:18.20.2-1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780, ELSA-2024-2778 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+90082+b6a613a6 | ELSA-2024-2780, ELSA-2024-2778 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-4.module+el8.9.0+90082+b6a613a6 | ELSA-2024-2780, ELSA-2024-2778 |
| Oracle Linux 8 | npm | 1:10.5.0-1.18.20.2.1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780, ELSA-2024-2778 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | c-ares | 1.27.0-r0 | — |
Advisories 42
- ALSA-2024:3842 Low: c-ares security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2910 Important: nodejs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2779 Important: nodejs:18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2853 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:4249 Low: c-ares security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2778 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2780 Important: nodejs:18 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:4721 Red Hat Security Advisory: nodejs security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:2853 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:2910 Red Hat Security Advisory: nodejs security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:2779 Red Hat Security Advisory: nodejs:18 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:2780 Red Hat Security Advisory: nodejs:18 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:2778 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2024-1337 Red Hat Enterprise Linux (c-ares): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 13, 2026
- SUSE-SU-2026:4021-1 Security update for c-ares SUSE / openSUSE Security Updates · Sep 13, 2026
- WID-SEC-2024-0992 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- RHSA-2024:4559 Red Hat Security Advisory: nodejs security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2024:3842 Red Hat Security Advisory: c-ares security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-6676-1 c-ares vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- RHSA-2024:4249 Red Hat Security Advisory: c-ares security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RLSA-2024:2778 Important: nodejs:20 security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2024:2780 Important: nodejs:18 security update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2024:13722-1 c-ares-devel-1.27.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1136-1 Security update for c-ares SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1136-2 Security update for c-ares SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1135-1 Security update for libcares2 SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2024:2910 Important: nodejs security update Rocky Linux Security Advisories · Oct 9, 2025
- RLSA-2024:2779 Important: nodejs:18 security update Rocky Linux Security Advisories · Oct 9, 2025
- RLSA-2024:2853 Important: nodejs:20 security update Rocky Linux Security Advisories · Oct 9, 2025
- RLSA-2024:3842 Low: c-ares security update Rocky Linux Security Advisories · Oct 7, 2025
- RLSA-2024:4249 Low: c-ares security update Rocky Linux Security Advisories · May 7, 2025
- ELSA-2024-4249 Low: c-ares security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 2, 2024
- ELSA-2024-3842 Low: c-ares security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 11, 2024
- ELSA-2024-2910 Important: nodejs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 22, 2024
- ELSA-2024-2853 Important: nodejs:20 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 16, 2024
- ELSA-2024-2779 Important: nodejs:18 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 14, 2024
- ELSA-2024-2780 Important: nodejs:18 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 10, 2024
- ELSA-2024-2778 Important: nodejs:20 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 9, 2024
- ALAS2023-2024-562 Moderate: nodejs20 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 21, 2024
- ALAS2023-2024-563 Moderate: c-ares security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 21, 2024
- ALAS2023-2024-568 Moderate: nodejs security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 21, 2024
- ALAS2-2024-2494 Moderate: c-ares security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 18, 2024
References
- https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q
- https://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX37LFPFQ3T6FFMMFYQTEGIQXXN7F27U/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2P76QYINQNPEHUTEEDOUYIRZ2X6UVZ5K/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSCMTSPDIE2UHU34TIXQQHZ6JTE3Y3VF/