Home

Description

c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

PUBLISHED Reserved 2025-10-13 | Published 2025-12-08 | Updated 2025-12-09 | Assigner GitHub_M




MEDIUM: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-416: Use After Free

Product status

> 1.32.3, < 1.34.6
affected

References

github.com/...c-ares/security/advisories/GHSA-jq53-42q6-pqr5

github.com/...ommit/714bf5675c541bd1e668a8db8e67ce012651e618

cve.org (CVE-2025-62408)

nvd.nist.gov (CVE-2025-62408)

Download JSON