CVE-2025-62408

c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

These are all security issues fixed in the c-ares-devel-1.34.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the istioctl-1.28.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for c-ares fixes the following issue

• CVE-2025-62408: use after free in read_answers() (bsc#1254738).

Changes for c-ares:

• c-ares 1.35.6:

• Ignore Windows IDN Search Domains until proper IDN support is added
• Various bug fixes

This update for c-ares fixes the following issue

• CVE-2025-62408: use after free in read_answers() (bsc#1254738).

Changes for c-ares:

• c-ares 1.35.6:

• Ignore Windows IDN Search Domains until proper IDN support is added
• Various bug fixes

This update for c-ares fixes the following issue

• CVE-2025-62408: use after free in read_answers() (bsc#1254738).

Changes for c-ares:

• c-ares 1.35.6:

• Ignore Windows IDN Search Domains until proper IDN support is added
• Various bug fixes

This update for c-ares fixes the following issues:

Update to c-ares 1.34.8.

• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).
• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• c-ares 1.34.8:
  • For details, see https://c-ares.org/changelog.html.
• c-ares 1.34.6:
  • Ignore Windows IDN Search Domains until proper IDN support is added.
  • Various bug fixes.
• c-ares 1.34.4:
  • Changes:
    • QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938
  • Bugfixes:
    • Empty TXT records were not being preserved. PR #922
    • docs: update deprecation notices for ares_create_query() and ares_mkquery(). PR #910
    • license: some files weren't properly updated. PR #920
    • Fix bind local device regression from 1.34.0. PR #929, PR #931, PR #935
    • CMake: set policy version to prevent deprecation warnings. PR #932
    • CMake: shared and static library names should be the same on unix platforms like autotools uses. PR #933
    • Update to latest autoconf archive macros for enhanced system compatibility. PR #936
• c-ares 1.34.3:
  • Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906
  • Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911
  • TSAN warns on missing lock, but lock isn't actually necessary. PR #915
  • ares_getaddrinfo() for AF_UNSPEC should retry IPv4 if only IPv6 is received. 765d558
  • ares_send() shouldn't return ARES_EBADRESP, its ARES_EBADQUERY. 91519e7
  • Fix typos in man pages. PR #905
• c-ares 1.34.2:
  • Features:
    • adig: read arguments from adigrc. [PR #856]
    • Add new pending write callback optimization via ares_set_pending_write_cb. [PR #857]
    • New function ares_process_fds(). [PR #875]
    • Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]
    • adig: rework command line arguments to mimic dig from bind. [PR #890]
    • Add new method for overriding network functions ares_set_socket_function_ex() to properly support all new functionality. [PR #894]
    • Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]
    • ares_socket: set IP_BIND_ADDRESS_NO_PORT on ares_set_local_ip* tcp sockets [PR #887]
    • URI parser/writer for ares_set_servers_csv()/ares_get_servers_csv(). [PR #882]
    • Connection handling modularization. [PR #857], [PR #876]
    • Expose library/utility functions to tools. [PR #860]
    • Remove ares__ prefix, just use ares_ for internal functions. [PR #872]
    • fix: potential WIN32_LEAN_AND_MEAN redefinition. [PR #869]
    • Fix googletest v1.15 compatibility. [PR #874]
    • Fix pkgconfig thread dependencies. [PR #884]
• c-ares 1.33.0:
  • Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]
  • Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]
  • Reorganize source tree. [PR #822]
  • Refactoring of connection handling to prevent code duplication. [PR #839]
  • New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]
  • ares_destroy() race condition during shutdown due to missing lock. [PR #831]
• c-ares in 1.32:
  • Add support for DNS 0x20 to help prevent cache poisoning attacks, enabled by specifying…

This update for c-ares fixes the following issues:

Update to c-ares 1.34.8.

• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).
• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• c-ares 1.34.8:
  • For details, see https://c-ares.org/changelog.html.
• c-ares 1.34.6:
  • Ignore Windows IDN Search Domains until proper IDN support is added.
  • Various bug fixes.
• c-ares 1.34.4:
  • Changes:
    • QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938
  • Bugfixes:
    • Empty TXT records were not being preserved. PR #922
    • docs: update deprecation notices for ares_create_query() and ares_mkquery(). PR #910
    • license: some files weren't properly updated. PR #920
    • Fix bind local device regression from 1.34.0. PR #929, PR #931, PR #935
    • CMake: set policy version to prevent deprecation warnings. PR #932
    • CMake: shared and static library names should be the same on unix platforms like autotools uses. PR #933
    • Update to latest autoconf archive macros for enhanced system compatibility. PR #936
• c-ares 1.34.3:
  • Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906
  • Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911
  • TSAN warns on missing lock, but lock isn't actually necessary. PR #915
  • ares_getaddrinfo() for AF_UNSPEC should retry IPv4 if only IPv6 is received. 765d558
  • ares_send() shouldn't return ARES_EBADRESP, its ARES_EBADQUERY. 91519e7
  • Fix typos in man pages. PR #905
• c-ares 1.34.2:
  • Features:
    • adig: read arguments from adigrc. [PR #856]
    • Add new pending write callback optimization via ares_set_pending_write_cb. [PR #857]
    • New function ares_process_fds(). [PR #875]
    • Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]
    • adig: rework command line arguments to mimic dig from bind. [PR #890]
    • Add new method for overriding network functions ares_set_socket_function_ex() to properly support all new functionality. [PR #894]
    • Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]
    • ares_socket: set IP_BIND_ADDRESS_NO_PORT on ares_set_local_ip* tcp sockets [PR #887]
    • URI parser/writer for ares_set_servers_csv()/ares_get_servers_csv(). [PR #882]
    • Connection handling modularization. [PR #857], [PR #876]
    • Expose library/utility functions to tools. [PR #860]
    • Remove ares__ prefix, just use ares_ for internal functions. [PR #872]
    • fix: potential WIN32_LEAN_AND_MEAN redefinition. [PR #869]
    • Fix googletest v1.15 compatibility. [PR #874]
    • Fix pkgconfig thread dependencies. [PR #884]
• c-ares 1.33.0:
  • Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]
  • Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]
  • Reorganize source tree. [PR #822]
  • Refactoring of connection handling to prevent code duplication. [PR #839]
  • New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]
  • ares_destroy() race condition during shutdown due to missing lock. [PR #831]
• c-ares in 1.32:
  • Add support for DNS 0x20 to help prevent cache poisoning attacks, enabled by specifying…

This update for c-ares fixes the following issues:

• CVE-2024-25629: out of bounds read in ares__read_line() (bsc#1220279).
• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
• CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: Memory-amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• updated to 1.36.8.

This update for nodejs18 fixes the following issues:

• CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
• CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
• CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
• CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
• CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
• CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
• CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
• CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
• CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS…

This update for nodejs18 fixes the following issues:

• CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
• CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
• CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
• CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
• CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
• CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
• CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
• CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
• CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS…

It was discovered that c-ares incorrectly handled terminating certain queries after a maximum number of attempts. An attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service.