Description
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| c-ares | c-ares | > 1.32.3, < 1.34.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | c-ares | 1.34.6-1 | — |
| Debian 13 | c-ares | 1.34.9-1~deb13u1 | DSA-6084-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | c-ares | 1.34.5-1ubuntu0.1 | USN-7925-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | c-ares +1 | 1.34.6-3.1.hum1 | RHSA-2026:7414 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES 15 SP6 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES 15 SP5 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES 15 SP5 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLES 15 SP4 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES 15 SP4 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLES 12 SP5 | nodejs18 | 18.20.8-8.44.1 | SUSE-SU-2026:4248-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES for SAP 15 SP5 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES for SAP 15 SP5 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLES for SAP 15 SP4 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLES for SAP 15 SP4 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLE Micro 6.1 | c-ares | 1.34.8-slfo.1.1_1.1 | SUSE-SU-2026:23414-1 |
| SLE Micro 6.0 | c-ares | 1.34.8-1.1 | SUSE-SU-2026:23364-1 |
| SLE Micro 5.5 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLE Micro 5.4 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLE Micro 5.3 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLE HPC 15 SP5 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLE HPC 15 SP5 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLE HPC 15 SP4 | c-ares | 1.34.8-150000.3.29.1 | SUSE-SU-2026:4021-1 |
| SLE HPC 15 SP4 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | c-ares | 1.34.6-1.1 | openSUSE-SU-2026:10007-1 |
| openSUSE Tumbleweed | istioctl | 1.28.2-1.1 | openSUSE-SU-2026:10029-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | c-ares | 1.34.6-r0 | — |
| Alpine v3.23 | c-ares | 1.34.6-r0 | — |
| Alpine v3.22 | c-ares | 1.34.6-r0 | — |
| Alpine v3.21 | c-ares | 1.34.6-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs20 +4 | 1:20.19.5-1.amzn2023.0.2 | ALAS2023-2025-1346 |
| Amazon Linux 2023 | nodejs20-npm | 1:10.8.2-1.20.19.5.1.amzn2023.0.2 | ALAS2023-2025-1346 |
| Amazon Linux 2023 | nodejs22 +4 | 1:22.21.1-1.amzn2023.0.2 | ALAS2023-2025-1347 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.4-1.22.21.1.1.amzn2023.0.2 | ALAS2023-2025-1347 |
| Amazon Linux 2023 | nodejs24 +4 | 1:24.11.1-1.amzn2023.0.2 | ALAS2023-2025-1348 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.6.2-1.24.11.1.1.amzn2023.0.2 | ALAS2023-2025-1348 |
| Amazon Linux 2023 | v8-11.3-devel | 3:11.3.244.8-1.20.19.5.1.amzn2023.0.2 | ALAS2023-2025-1346 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.21.1.1.amzn2023.0.2 | ALAS2023-2025-1347 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.10-1.24.11.1.1.amzn2023.0.2 | ALAS2023-2025-1348 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | fluent-bit | 3.1.10-4 | — |
Advisories 15
- RHSA-2026:7414 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- SUSE-SU-2026:4261-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Sep 18, 2026
- SUSE-SU-2026:4248-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Sep 18, 2026
- SUSE-SU-2026:23414-1 Security update for c-ares SUSE / openSUSE Security Updates · Sep 14, 2026
- SUSE-SU-2026:4021-1 Security update for c-ares SUSE / openSUSE Security Updates · Sep 13, 2026
- SUSE-SU-2026:23364-1 Security update for c-ares SUSE / openSUSE Security Updates · Sep 10, 2026
- WID-SEC-2026-1730 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 16, 2026
- WID-SEC-2025-2922 NetApp Data ONTAP: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 10, 2026
- USN-7925-1 c-ares vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2026:10029-1 istioctl-1.28.2-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:10007-1 c-ares-devel-1.34.6-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- ALAS2023-2025-1346 Moderate: nodejs20 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jan 7, 2026
- ALAS2023-2025-1347 Moderate: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jan 7, 2026
- ALAS2023-2025-1348 Moderate: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jan 7, 2026
- DSA-6084-1 c-ares - security update Debian Security (DSA / DLA) · Dec 18, 2025