c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade c-ares | Dec 15, 2025 | Dec 8, 2025 |
| Amazon_linux_2023 | — | Upgrade nodejs22-debuginfoUpgrade nodejs22-libs-debuginfoUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-full-i18nUpgrade nodejs24-docsUpgrade nodejs22-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24-npmUpgrade v8-11.3-develUpgrade nodejs24-full-i18nUpgrade nodejs20Upgrade nodejs22-libsUpgrade nodejs20-develUpgrade nodejs20-debuginfoUpgrade nodejs22-develUpgrade v8-12.4-develUpgrade v8-13.6-develUpgrade nodejs22-docsUpgrade nodejs20-full-i18nUpgrade nodejs22-npmUpgrade nodejs20-libsUpgrade nodejs24Upgrade nodejs24-debugsourceUpgrade nodejs24-develUpgrade nodejs22Upgrade nodejs20-docsUpgrade nodejs24-libsUpgrade nodejs20-debugsource | Jan 12, 2026 | Dec 8, 2025 |
| Debian | — | Upgrade c-ares | Jul 23, 2026 | Jul 23, 2026 |
| Freebsd | — | Upgrade c-ares | Jan 27, 2026 | Dec 9, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 8, 2025 |
| Ubuntu | — | Upgrade libcares2 | Dec 12, 2025 | Dec 8, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub