c-ares vulnerabilities

CVEs per yearBy the year they were published

1. 20234
2. 20241
3. 20252
4. 20263

Newest CVEs

• CVE-2026-69184

  c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

  c-ares · c-ares

  High7.5
• CVE-2026-69186

  c-ares: Memory-amplification denial of service via unvalidated DNS header record counts

  c-ares · c-ares

  Medium5.3
• CVE-2026-33630

  c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP

  c-ares · c-ares

  High7.5
• CVE-2025-62408

  c-ares has a Use After Free vulnerability when connection is cleaned up after error

  c-ares · c-ares

  Medium5.9
• CVE-2025-31498

  c-ares has a use-after-free in read_answers()

  c-ares · c-ares

  High8.3
• CVE-2024-25629

  c-ares out of bounds read in ares__read_line()

  c-ares · c-ares

  Medium4.4
• CVE-2023-32067

  0-byte UDP payload DoS in c-ares

  c-ares · c-ares

  High7.5
• CVE-2023-31147

  Insufficient randomness in generation of DNS query IDs in c-ares

  c-ares · c-ares

  Medium5.9
• CVE-2023-31130

  Buffer Underwrite in ares_inet_net_pton()

  c-ares · c-ares

  Medium4.1
• CVE-2023-31124

  AutoTools does not set CARES_RANDOM_FILE during cross compilation

  c-ares · c-ares

  Low3.7