c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade c-ares | Dec 15, 2025 | Dec 8, 2025 |
| Amazon_linux_2023 | — | Upgrade nodejs24-docsUpgrade nodejs20-debuginfoUpgrade nodejs20-npmUpgrade nodejs22-full-i18nUpgrade nodejs20Upgrade nodejs22-libsUpgrade nodejs22-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs22-develUpgrade v8-11.3-develUpgrade nodejs22-debuginfoUpgrade v8-12.4-develUpgrade nodejs24-npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs20-develUpgrade nodejs20-libs-debuginfoUpgrade nodejs22-libs-debuginfoUpgrade nodejs24Upgrade nodejs22Upgrade nodejs24-debugsourceUpgrade nodejs22-docsUpgrade nodejs20-libsUpgrade nodejs22-npmUpgrade nodejs20-full-i18nUpgrade nodejs24-libsUpgrade nodejs24-develUpgrade nodejs20-debugsourceUpgrade v8-13.6-develUpgrade nodejs20-docs | Jan 12, 2026 | Dec 8, 2025 |
| Debian | — | Upgrade c-ares | Jul 23, 2026 | Jul 23, 2026 |
| Freebsd | — | Upgrade c-ares | Jan 27, 2026 | Dec 9, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 8, 2025 |
| Ubuntu | — | Upgrade libcares2 | Dec 12, 2025 | Dec 8, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub