c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade v8-12.4-develUpgrade npmUpgrade nodejs-libsUpgrade nodejs-nodemon | May 9, 2025 | Apr 8, 2025 |
| Alpine Linux | — | Upgrade c-ares | Aug 8, 2025 | Apr 8, 2025 |
| Amazon_linux_2023 | — | Upgrade nodejs20-libs-debuginfoUpgrade nodejs20-full-i18nUpgrade nodejs20-debugsourceUpgrade nodejs20-debuginfoUpgrade nodejs20-docsUpgrade nodejs20Upgrade nodejs20-npmUpgrade nodejs20-develUpgrade v8-11.3-develUpgrade nodejs20-libs | Apr 30, 2025 | Apr 8, 2025 |
| Debian | — | Upgrade c-ares | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade npmUpgrade nodejs-devel | May 6, 2025 | Apr 8, 2025 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs22-debuginfoUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-packagingNo solution existsUpgrade nodejs-debugsourceUpgrade npm | May 6, 2025 | Apr 8, 2025 |
| Rocky_linux | — | Upgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade v8-12.4-develUpgrade npmUpgrade nodejs-develUpgrade nodejs-debuginfo | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade c-ares-utilsUpgrade c-ares-develUpgrade libcares2 | Dec 5, 2025 | May 7, 2025 |
| Ubuntu | — | Upgrade libcares2 | May 6, 2025 | Apr 8, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub