C-ares vulnerabilities
We track 5 vulnerabilities in C-ares products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 18, 2026.
Latest C-ares vulnerabilities
- 7.5 High severity
c-ares: Inefficient Algorithmic Complexity
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long desce
- 7.5 High severity
c-ares: Double Free
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup str
- 8.3 High severity
c-ares: Use After Free
c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or p
- 7.5 High severity
c-ares: Uncontrolled Resource Consumption
c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously in
- 8.6 High severity
c-ares: Improper Validation of Specified Quantity in Input
A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and