{"id":"CVE-2025-31498","aliases":["ALPINE-CVE-2025-31498","ALSA-2025:4459","ALSA-2025:4461","ALSA-2025:7426","ALSA-2025:7433","ALSA-2025:7502","AZL-59742","BELL-CVE-2025-31498","DEBIAN-CVE-2025-31498","EUVD-2025-10377","GHSA-6hxc-62jh-p29v","RHSA-2025:4459","RHSA-2025:4461","RHSA-2025:7426","RHSA-2025:7433","RHSA-2025:7502","RHSA-2025:7537","RLSA-2025:4459","RLSA-2025:4461","RLSA-2025:7426","RLSA-2025:7433","ROOT-OS-ALPINE-320-CVE-2025-31498","SUSE-SU-2026:23364-1","SUSE-SU-2026:23414-1","SUSE-SU-2026:4021-1","UBUNTU-CVE-2025-31498","USN-7477-1","openSUSE-SU-2025:14977-1"],"status":"published","title":"c-ares has a use-after-free in read_answers()","description":"c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00602,"percentile":0.49121,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2025-04-08T13:53:11Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"c-ares","fixed_in":["1.34.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"c-ares","fixed_in":["1.34.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"c-ares","fixed_in":["1.34.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"c-ares","fixed_in":["1.34.5-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs","fixed_in":["1:20.19.1-1.module_el8.10.0+3987+dbda4426"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-devel","fixed_in":["1:20.19.1-1.module_el8.10.0+3987+dbda4426"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-docs","fixed_in":["1:20.19.1-1.module_el8.10.0+3987+dbda4426"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","fixed_in":["1:20.19.1-1.module_el8.10.0+3987+dbda4426"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","fixed_in":["3.0.1-1.module_el8.10.0+3982+85c136aa"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-packaging","fixed_in":["2021.06-4.module_el8.10.0+3987+dbda4426"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","fixed_in":["2021.06-4.module_el8.10.0+3958+472a6467"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"npm","fixed_in":["1:10.8.2-1.20.19.1.1.module_el8.10.0+3987+dbda4426"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs","fixed_in":["1:20.19.1-1.module_el9.6.0+163+d268fe53"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-devel","fixed_in":["1:20.19.1-1.module_el9.6.0+163+d268fe53"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-docs","fixed_in":["1:20.19.1-1.module_el9.6.0+163+d268fe53"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","fixed_in":["1:20.19.1-1.module_el9.6.0+163+d268fe53"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","fixed_in":["3.0.1-1.module_el9.5.0+125+8dc38870"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-packaging","fixed_in":["2021.06-4.module_el9.6.0+162+8dc602e5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","fixed_in":["2021.06-4.module_el9.6.0+162+8dc602e5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"npm","fixed_in":["1:10.8.2-1.20.19.1.1.module_el9.6.0+163+d268fe53"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"nodejs","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"nodejs-devel","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"nodejs-docs","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"nodejs-full-i18n","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"nodejs-libs","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"nodejs-npm","fixed_in":["1:10.9.2-1.22.15.0.1.el10_0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"fluent-bit","fixed_in":["3.1.9-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"c-ares","fixed_in":["1.34.5-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"c-ares","fixed_in":["1.34.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"c-ares","fixed_in":["1.34.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"c-ares","fixed_in":["1.34.5-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","fixed_in":["1:20.19.1-1.module+el8.10.0+23054+5431297f"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","fixed_in":["1:20.19.1-1.module+el8.10.0+23054+5431297f"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","fixed_in":["1:20.19.1-1.module+el8.10.0+23054+5431297f"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","fixed_in":["1:20.19.1-1.module+el8.10.0+23054+5431297f"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","fixed_in":["1:20.19.1-1.module+el8.10.0+23054+5431297f"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","fixed_in":["1:20.19.1-1.module+el8.10.0+23054+5431297f"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","fixed_in":["0:3.0.1-1.module+el8.10.0+22904+d0fedeff"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","fixed_in":["0:2021.06-4.module+el8.10.0+22904+d0fedeff"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","fixed_in":["0:2021.06-4.module+el8.10.0+22904+d0fedeff"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","fixed_in":["1:10.8.2-1.20.19.1.1.module+el8.10.0+23054+5431297f"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","fixed_in":["1:20.19.1-1.module+el9.6.0+23053+4195b0b2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","fixed_in":["1:20.19.1-1.module+el9.6.0+23053+4195b0b2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","fixed_in":["1:20.19.1-1.module+el9.6.0+23053+4195b0b2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","fixed_in":["1:20.19.1-1.module+el9.6.0+23053+4195b0b2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","fixed_in":["1:20.19.1-1.module+el9.6.0+23053+4195b0b2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","fixed_in":["1:20.19.1-1.module+el9.6.0+23053+4195b0b2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","fixed_in":["0:3.0.1-1.module+el9.3.0.z+20478+84a9f781"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","fixed_in":["0:2021.06-4.module+el9.3.0+19518+63aad52d"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","fixed_in":["0:2021.06-4.module+el9.3.0+19518+63aad52d"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","fixed_in":["1:10.8.2-1.20.19.1.1.module+el9.6.0+23053+4195b0b2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-debuginfo","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-devel","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-docs","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-full-i18n","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-libs","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-libs-debuginfo","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-npm","fixed_in":["1:10.9.2-1.22.15.0.1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs22","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs22-debuginfo","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs22-debugsource","fixed_in":["1:22.15.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs","fixed_in":["1:20.18.2-2.module+el9.4.0+23089+aaa18a20"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-debuginfo","fixed_in":["1:20.18.2-2.module+el9.4.0+23089+aaa18a20"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-debugsource","fixed_in":["1:20.18.2-2.module+el9.4.0+23089+aaa18a20"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-devel","fixed_in":["1:20.18.2-2.module+el9.4.0+23089+aaa18a20"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-docs","fixed_in":["1:20.18.2-2.module+el9.4.0+23089+aaa18a20"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-full-i18n","fixed_in":["1:20.18.2-2.module+el9.4.0+23089+aaa18a20"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-nodemon","fixed_in":["0:3.0.1-1.module+el9.3.0.z+20478+84a9f781"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-packaging","fixed_in":["0:2021.06-4.module+el9.3.0+19518+63aad52d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-packaging-bundler","fixed_in":["0:2021.06-4.module+el9.3.0+19518+63aad52d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"npm","fixed_in":["1:10.8.2-1.20.18.2.2.module+el9.4.0+23089+aaa18a20"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"nodejs","fixed_in":["1:20.19.1-1.module+el8.10.0+1972+57cf735f"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","fixed_in":["0:3.0.1-1.module+el8.10.0+1988+437f3d23","0:3.0.1-1.module+el8.10.0+1989+e60144d9","0:3.0.1-1.module+el8.9.0+1760+903d54b9","0:3.0.1-1.module+el8.10.0+1666+930e28e8","0:3.0.1-1.module+el8.10.0+1667+4a788d89","0:3.0.1-1.module+el8.10.0+1823+b5789597","0:3.0.1-1.module+el8.10.0+1824+532140ee","0:3.0.1-1.module+el8.10.0+1924+614dc87f","0:3.0.1-1.module+el8.10.0+1935+d3cbe60f"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"nodejs-packaging","fixed_in":["0:2021.06-4.module+el8.10.0+1667+4a788d89","0:2021.06-4.module+el8.10.0+1823+b5789597","0:2021.06-4.module+el8.10.0+1824+532140ee","0:2021.06-4.module+el8.10.0+1924+614dc87f","0:2021.06-4.module+el8.10.0+1988+437f3d23","0:2021.06-4.module+el8.10.0+1989+e60144d9","0:2021.06-4.module+el8.9.0+1419+1f26ef47"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","fixed_in":["0:3.0.1-1.module+el9.5.0+31770+0da7192d","0:3.0.1-1.module+el9.5.0+31785+5534beb0"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"nodejs-packaging","fixed_in":["0:2021.06-4.module+el9.5.0+31770+0da7192d","0:2021.06-4.module+el9.5.0+31786+d18c719d","0:2021.06-4.module+el9.5.0+31785+5534beb0"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"c-ares","fixed_in":["1.33.1-r00071","1.33.1-r00072","1.33.1-r00073","1.33.1-r00074"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-c-ares","fixed_in":["1.33.1-r00071","1.33.1-r00072","1.33.1-r00073","1.33.1-r00074"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.04","package":"c-ares","fixed_in":["1.34.4-2.1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"c-ares","fixed_in":["1.34.5-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.10.0+3983+391a1a04"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3961+6a788e57"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3961+6a788e57"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.15.0.1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module_el8.10.0+3987+dbda4426"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module_el8.10.0+3987+dbda4426"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module_el8.10.0+3987+dbda4426"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module_el8.10.0+3987+dbda4426"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.10.0+3982+85c136aa"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3987+dbda4426"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3958+472a6467"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.19.1.1.module_el8.10.0+3987+dbda4426"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module_el9.6.0+163+d268fe53"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module_el9.6.0+163+d268fe53"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module_el9.6.0+163+d268fe53"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module_el9.6.0+163+d268fe53"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.5.0+125+8dc38870"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.6.0+162+8dc602e5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.6.0+162+8dc602e5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.19.1.1.module_el9.6.0+163+d268fe53"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.5.0+139+09296491"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.5.0+139+09296491"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.5.0+139+09296491"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.15.0.1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.15.0.1.module_el9.6.0+164+2d89b8ed"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.15.0.1.el10_0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"fluent-bit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.9-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.3-r0"},{"fixed":"1.34.5-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.3-r0"},{"fixed":"1.34.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.5-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.15.0.1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.15.0.1.module+el8.10.0+23068+28ff2340"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el8.10.0+23054+5431297f"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el8.10.0+23054+5431297f"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el8.10.0+23054+5431297f"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el8.10.0+23054+5431297f"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el8.10.0+23054+5431297f"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el8.10.0+23054+5431297f"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+22904+d0fedeff"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+22904+d0fedeff"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+22904+d0fedeff"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.19.1.1.module+el8.10.0+23054+5431297f"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el9.6.0+23053+4195b0b2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el9.6.0+23053+4195b0b2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el9.6.0+23053+4195b0b2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el9.6.0+23053+4195b0b2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el9.6.0+23053+4195b0b2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el9.6.0+23053+4195b0b2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.3.0.z+20478+84a9f781"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.19.1.1.module+el9.6.0+23053+4195b0b2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.15.0.1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.15.0.1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.15.0.1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-2.module+el9.4.0+23089+aaa18a20"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-2.module+el9.4.0+23089+aaa18a20"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-2.module+el9.4.0+23089+aaa18a20"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-2.module+el9.4.0+23089+aaa18a20"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-2.module+el9.4.0+23089+aaa18a20"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.18.2-2.module+el9.4.0+23089+aaa18a20"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.3.0.z+20478+84a9f781"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.18.2.2.module+el9.4.0+23089+aaa18a20"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.15.0-1.module+el8.10.0+1971+0bb08ece"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1667+4a788d89"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1823+b5789597"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1924+614dc87f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1935+d3cbe60f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1823+b5789597"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1824+532140ee"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1924+614dc87f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1988+437f3d23"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1989+e60144d9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+1419+1f26ef47"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.1-1.module+el8.10.0+1972+57cf735f"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1667+4a788d89"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1823+b5789597"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1924+614dc87f"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1935+d3cbe60f"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1823+b5789597"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1824+532140ee"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1924+614dc87f"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1988+437f3d23"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1989+e60144d9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+1419+1f26ef47"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31785+5534beb0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31786+d18c719d"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31785+5534beb0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31785+5534beb0"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31786+d18c719d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31785+5534beb0"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-r00071"},{"fixed":"1.33.1-r00072"},{"fixed":"1.33.1-r00073"},{"fixed":"1.33.1-r00074"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-r00071"},{"fixed":"1.33.1-r00072"},{"fixed":"1.33.1-r00073"},{"fixed":"1.33.1-r00074"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-slfo.1.1_1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:25.04","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.4-2.1ubuntu0.1"}]}],"versions":["1.33.0-1","1.34.2-1","1.34.3-1","1.34.4-1","1.34.4-2.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.5-1.1"}]}]}],"products":[{"vendor":"c-ares","product":"c-ares"}],"references":[{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-6hxc-62jh-p29v","tags":["x_refsource_CONFIRM","advisory","article","report"]},{"url":"https://github.com/c-ares/c-ares/pull/821","tags":["x_refsource_MISC","fix","article","report"]},{"url":"https://github.com/c-ares/c-ares/commit/29d38719112639d8c0ba910254a3dd4f482ea2d1","tags":["x_refsource_MISC","fix","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/08/3","tags":["web","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-31498","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4459","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-31498","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-3277","tags":["report"]},{"url":"https://bugzilla.redhat.com/2358271","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359553","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-4459.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4461","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-4461.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7426","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7426.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7433","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7433.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7502","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-7502.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31498","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-31498","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2025-4","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31498.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-31498","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2358271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359553","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-78761","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-88883","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4459.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-3277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3277","tags":["advisory"]},{"url":"https://sqlite.org/src/info/498e3f1cf57f164f","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-31498","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-78763","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4461.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7426.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7433.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7502.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7537","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7537.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:4459","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:4461","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7426","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7433","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623364-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240955","tags":["report"]},{"url":"https://bugzilla.suse.com/1254738","tags":["report"]},{"url":"https://bugzilla.suse.com/1270416","tags":["report"]},{"url":"https://bugzilla.suse.com/1276290","tags":["report"]},{"url":"https://bugzilla.suse.com/1276291","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623414-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264021-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220279","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25629","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-31498","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7477-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-31498","title":"c-ares has a use-after-free in read_answers()","description":"c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.","status":"published","published":"2025-04-08T13:53:11.232Z","modified":"2025-04-08T18:40:36.081Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:32:44.424933Z"}],"euvd":[{"id":"EUVD-2025-10377","description":"c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.","status":"published","published":"2025-04-08T13:53:11Z","modified":"2025-04-08T18:40:36Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T20:52:39.117101Z"}],"nvd":[{"id":"CVE-2025-31498","description":"c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.","status":"published","published":"2025-04-08T14:15:35.293Z","modified":"2026-06-17T09:10:30.347Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:10:59.48027Z"}],"osv":[{"id":"ALPINE-CVE-2025-31498","description":"c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.","status":"published","published":"2025-04-08T14:15:35.293Z","modified":"2026-08-27T22:18:02.879116621Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"CVE-2025-31498","title":"c-ares has a use-after-free in read_answers()","description":"c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.","status":"published","published":"2025-04-08T13:53:11.232Z","modified":"2026-10-28T10:51:35.303332888Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"DEBIAN-CVE-2025-31498","description":"c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.","status":"published","published":"2025-04-08T14:15:35.293Z","modified":"2026-09-01T20:05:45.770401975Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"RHSA-2025:4459","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2025-05-06T10:03:56Z","modified":"2026-09-09T10:06:27Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:4461","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2025-05-06T10:03:57Z","modified":"2026-09-09T10:06:27Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7426","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2025-05-14T10:06:20Z","modified":"2026-09-09T10:06:35Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7433","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2025-05-14T10:06:25Z","modified":"2026-09-09T10:06:36Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7502","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2025-05-14T10:06:42Z","modified":"2026-09-09T10:06:40Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7537","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2025-05-14T10:06:54Z","modified":"2026-09-09T10:06:42Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:4459","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n\n* SQLite: integer overflow in SQLite (CVE-2025-3277)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:06.677557Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:4461","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:07.051925Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7426","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:40:19.644888Z","modified":"2025-07-29T14:33:26.363945Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7433","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n\n* SQLite: integer overflow in SQLite (CVE-2025-3277)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:40:19.644888Z","modified":"2025-07-29T14:33:26.426128Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2025-31498","description":"c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.","status":"withdrawn","published":"2025-04-08T14:15:00Z","modified":"2026-02-04T02:16:07.545168Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:28.829873Z"},{"id":"ALSA-2025:4459","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n  * SQLite: integer overflow in SQLite (CVE-2025-3277)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-05T00:00:00Z","modified":"2026-10-29T11:02:22.984295206Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:4461","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-05T00:00:00Z","modified":"2026-10-29T11:02:23.031865242Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7426","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:32:17.18952303Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7433","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n  * SQLite: integer overflow in SQLite (CVE-2025-3277)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:32:16.624042747Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7502","title":"Moderate: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:58:17.018107Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-59742","title":"CVE-2025-31498 affecting package fluent-bit for versions less than 3.1.9-4","description":"c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.","status":"published","published":"2025-04-08T14:15:35Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.344052Z"},{"id":"BELL-CVE-2025-31498","status":"published","published":"2025-04-10T05:58:38.586999Z","modified":"2026-01-26T09:39:06.845972Z","updated_at":"2026-11-02T15:28:21.741325Z"},{"id":"openSUSE-SU-2025:14977-1","title":"c-ares-devel-1.34.5-1.1 on GA media","description":"These are all security issues fixed in the c-ares-devel-1.34.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-09T00:00:00Z","modified":"2026-02-04T04:20:45.777723Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2025-31498","title":"CVE-2025-31498 in c-ares - Patched by Root","description":"Root has patched CVE-2025-31498 in the c-ares package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-10-07T09:08:38Z","modified":"2026-10-07T10:15:07.521020064Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"SUSE-SU-2026:23364-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdate to c-ares 1.34.8.\n\n- CVE-2025-31498: use-after-free in `read_answers()` when `process_answer()` may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- c-ares 1.34.8:\n  * For details, see https://c-ares.org/changelog.html.\n- c-ares 1.34.6:\n  * Ignore Windows IDN Search Domains until proper IDN support is added.\n  * Various bug fixes.\n- c-ares 1.34.4:\n  * Changes:\n    -  QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938\n  * Bugfixes:\n    - Empty TXT records were not being preserved. PR #922\n    - `docs`: update deprecation notices for `ares_create_query()` and `ares_mkquery()`. PR #910\n    - `license`: some files weren't properly updated. PR #920\n    - Fix `bind` local device regression from 1.34.0. PR #929, PR #931, PR #935\n    - `CMake`: set policy version to prevent deprecation warnings. PR #932\n    - `CMake`: shared and static library names should be the same on unix platforms like `autotools` uses. PR #933\n    - Update to latest `autoconf` archive macros for enhanced system compatibility. PR #936\n- c-ares 1.34.3:\n  * Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906\n  * Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911\n  * TSAN warns on missing lock, but lock isn't actually necessary. PR #915\n  * `ares_getaddrinfo(`) for `AF_UNSPEC` should retry IPv4 if only IPv6 is received. 765d558\n  * `ares_send()` shouldn't return `ARES_EBADRESP`, its `ARES_EBADQUERY`. 91519e7\n  * Fix typos in man pages. PR #905\n- c-ares 1.34.2:\n  * Features:\n    - `adig`: read arguments from `adigrc`. [PR #856]\n    - Add new pending write callback optimization via `ares_set_pending_write_cb`. [PR #857]\n    - New function `ares_process_fds()`. [PR #875]\n    - Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]\n    - `adig`: rework command line arguments to mimic `dig` from `bind`. [PR #890]\n    - Add new method for overriding network functions `ares_set_socket_function_ex()` to properly support all new\n      functionality. [PR #894]\n    - Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]\n    - `ares_socket`: set `IP_BIND_ADDRESS_NO_PORT` on `ares_set_local_ip*` tcp sockets [PR #887]\n    - URI parser/writer for `ares_set_servers_csv()`/`ares_get_servers_csv()`. [PR #882]\n    - Connection handling modularization. [PR #857], [PR #876]\n    - Expose library/utility functions to tools. [PR #860]\n    - Remove `ares__` prefix, just use `ares_` for internal functions. [PR #872]\n    - fix: potential `WIN32_LEAN_AND_MEAN` redefinition. [PR #869]\n    - Fix `googletest` v1.15 compatibility. [PR #874]\n    - Fix `pkgconfig` thread dependencies. [PR #884]\n- c-ares 1.33.0:\n  * Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]\n  * Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]\n  * Reorganize source tree. [PR #822]\n  * Refactoring of connection handling to prevent code duplication. [PR #839]\n  * New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]\n  * `ares_destroy()` race condition during shutdown due to missing lock. [PR #831]\n- c-ares in 1.32:\n  * Add support for DNS `0x20` to help prevent cache poisoning attacks, enabled by specifying `ARES_FLAG_DNS0x20`.\n    Disabled by default. [PR #800]\n  * Rework query timeout logic to automatically adjust timeouts based on network conditions. The timeout specified now\n    is only used as a hint until there is enough history to calculate a more valid timeout. [PR #794]\n  * DNS RR `TXT` strings should not be automatically concatenated as there are use cases outside of RFC 7208. In order\n    to maintain ABI compliance, the ability to retrieve `TXT` strings concatenated is retained as well as a new API to\n    retrieve the individual strings. This restores behavior from c-ares 1.20.0. [PR #801]\n  * Clean up header inclusion logic to make hacking on code easier. [PR #797]\n  * GCC/Clang: Enable even more strict warnings to catch more coding flaws. [253bdee]\n  * Tests: Fix thread race condition in test cases for `EventThread`. [PR #803]\n  * Thread Saftey: `ares_timeout()` was missing lock. [74a64e4]\n- c-ares 1.31.0:\n  * Enable Query Cache by default. [PR #786]\n  * Enhance Windows DNS configuration change detection to also detect manual DNS configuration changes. [PR #785]\n  * Various legacy MacOS Build fixes. [Issue #782]\n  * Ndots value of zero in `resolv.conf` was not being honored. [852a60a]\n  * Watt-32 build support had been broken for some time. [PR #781]\n  * Distribute `ares_dns_rec_type_tostr` manpage. [PR #778]\n- c-ares 1.30.0:\n  * Basic support for SIG RR record (RFC 2931 / RFC 2535) [PR #773]\n  * Validation that DNS strings can only consist of printable ascii characters otherwise will trigger a parse failure.\n    [75de16c] and [40fb125]\n  * `QueryCache`: Fix issue where purging on server changes wasn't working. [a6c8fe6]\n- c-ares 1.29.0:\n  * When using `ARES_OPT_EVENT_THREAD`, automatically reload system configuration when network conditions change.\n    [PR #759]\n  * Apple: reimplement DNS configuration reading to more accurately pull DNS settings. [PR #750]\n  * Add observability into DNS server health via a server state callback, invoked whenever a query finishes. [PR #744]\n  * Add server failover retry behavior, where failed servers are retried with small probability after a minimum delay.\n    [PR #731]\n  * Mark `ares_channel_t *` as `const` in more places in the public API. [PR #758]\n  * Due to a logic flaw, dns name compression writing was not properly implemented which would result in the name prefix\n    not being written for a partial match. This could cause issues in various record types such as `MX` records when\n    using the deprecated API. Regression introduced in 1.28.0. [Issue #757]\n  * Revert OpenBSD `SOCK_DNS` flag, it doesn't do what the docs say it does and causes c-ares to become non-functional.\n    [PR #754]\n  * `ares_getnameinfo()`: loosen validation on `salen` parameter. [Issue #752]\n  * `cmake`: Android requires C99. [PR #748]\n  * `ares_queue_wait_empty()` does not honor `timeout_ms \u003e= 0`. [Issue #742]\n- c-ares 1.28.1:\n  * Emit warnings when deprecated c-ares functions are used. This can be disabled by passing a compiler definition of\n   `CARES_NO_DEPRECATED`. [PR #732]\n  * Add function `ares_search_dnsrec()` to search for records using the new DNS record data structures. [PR #719]\n  * Rework internals to pass around `ares_dns_record_t` instead of binary data, this introduces new public functions of\n    `ares_query_dnsrec()` and `ares_send_dnsrec()`. [PR #730]\n  * tests: when performing simulated queries, reduce timeouts to make tests run faster.\n  * Replace configuration file parsers with memory-safe parser. [PR #725]\n  * Remove `acountry` completely, the manpage might still get installed otherwise. [Issue #718]\n  * CMake: don't overwrite global required libraries/definitions/includes which could cause build errors for projects\n    chain building c-ares. [Issue #729]\n  * On some platforms, `netinet6/in6.h` is not included by `netinet/in.h` and needs to be included separately. [PR #728]\n  * Fix a potential memory leak in `ares_init()`. [Issue #724]\n  * Some platforms don't have the `isascii()` function. Implement as a macro. [PR #721]\n  * CMake: Fix chain building if `CMAKE` runtime paths not set.\n  * NDots configuration should allow a value of zero. [PR #735]\n","status":"published","published":"2026-08-28T11:28:12Z","modified":"2026-09-10T18:23:13.347908946Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23414-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdate to c-ares 1.34.8.\n\n- CVE-2025-31498: use-after-free in `read_answers()` when `process_answer()` may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- c-ares 1.34.8:\n  * For details, see https://c-ares.org/changelog.html.\n- c-ares 1.34.6:\n  * Ignore Windows IDN Search Domains until proper IDN support is added.\n  * Various bug fixes.\n- c-ares 1.34.4:\n  * Changes:\n    -  QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938\n  * Bugfixes:\n    - Empty TXT records were not being preserved. PR #922\n    - `docs`: update deprecation notices for `ares_create_query()` and `ares_mkquery()`. PR #910\n    - `license`: some files weren't properly updated. PR #920\n    - Fix `bind` local device regression from 1.34.0. PR #929, PR #931, PR #935\n    - `CMake`: set policy version to prevent deprecation warnings. PR #932\n    - `CMake`: shared and static library names should be the same on unix platforms like `autotools` uses. PR #933\n    - Update to latest `autoconf` archive macros for enhanced system compatibility. PR #936\n- c-ares 1.34.3:\n  * Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906\n  * Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911\n  * TSAN warns on missing lock, but lock isn't actually necessary. PR #915\n  * `ares_getaddrinfo(`) for `AF_UNSPEC` should retry IPv4 if only IPv6 is received. 765d558\n  * `ares_send()` shouldn't return `ARES_EBADRESP`, its `ARES_EBADQUERY`. 91519e7\n  * Fix typos in man pages. PR #905\n- c-ares 1.34.2:\n  * Features:\n    - `adig`: read arguments from `adigrc`. [PR #856]\n    - Add new pending write callback optimization via `ares_set_pending_write_cb`. [PR #857]\n    - New function `ares_process_fds()`. [PR #875]\n    - Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]\n    - `adig`: rework command line arguments to mimic `dig` from `bind`. [PR #890]\n    - Add new method for overriding network functions `ares_set_socket_function_ex()` to properly support all new\n      functionality. [PR #894]\n    - Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]\n    - `ares_socket`: set `IP_BIND_ADDRESS_NO_PORT` on `ares_set_local_ip*` tcp sockets [PR #887]\n    - URI parser/writer for `ares_set_servers_csv()`/`ares_get_servers_csv()`. [PR #882]\n    - Connection handling modularization. [PR #857], [PR #876]\n    - Expose library/utility functions to tools. [PR #860]\n    - Remove `ares__` prefix, just use `ares_` for internal functions. [PR #872]\n    - fix: potential `WIN32_LEAN_AND_MEAN` redefinition. [PR #869]\n    - Fix `googletest` v1.15 compatibility. [PR #874]\n    - Fix `pkgconfig` thread dependencies. [PR #884]\n- c-ares 1.33.0:\n  * Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]\n  * Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]\n  * Reorganize source tree. [PR #822]\n  * Refactoring of connection handling to prevent code duplication. [PR #839]\n  * New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]\n  * `ares_destroy()` race condition during shutdown due to missing lock. [PR #831]\n- c-ares in 1.32:\n  * Add support for DNS `0x20` to help prevent cache poisoning attacks, enabled by specifying `ARES_FLAG_DNS0x20`.\n    Disabled by default. [PR #800]\n  * Rework query timeout logic to automatically adjust timeouts based on network conditions. The timeout specified now\n    is only used as a hint until there is enough history to calculate a more valid timeout. [PR #794]\n  * DNS RR `TXT` strings should not be automatically concatenated as there are use cases outside of RFC 7208. In order\n    to maintain ABI compliance, the ability to retrieve `TXT` strings concatenated is retained as well as a new API to\n    retrieve the individual strings. This restores behavior from c-ares 1.20.0. [PR #801]\n  * Clean up header inclusion logic to make hacking on code easier. [PR #797]\n  * GCC/Clang: Enable even more strict warnings to catch more coding flaws. [253bdee]\n  * Tests: Fix thread race condition in test cases for `EventThread`. [PR #803]\n  * Thread Saftey: `ares_timeout()` was missing lock. [74a64e4]\n- c-ares 1.31.0:\n  * Enable Query Cache by default. [PR #786]\n  * Enhance Windows DNS configuration change detection to also detect manual DNS configuration changes. [PR #785]\n  * Various legacy MacOS Build fixes. [Issue #782]\n  * Ndots value of zero in `resolv.conf` was not being honored. [852a60a]\n  * Watt-32 build support had been broken for some time. [PR #781]\n  * Distribute `ares_dns_rec_type_tostr` manpage. [PR #778]\n- c-ares 1.30.0:\n  * Basic support for SIG RR record (RFC 2931 / RFC 2535) [PR #773]\n  * Validation that DNS strings can only consist of printable ascii characters otherwise will trigger a parse failure.\n    [75de16c] and [40fb125]\n  * `QueryCache`: Fix issue where purging on server changes wasn't working. [a6c8fe6]\n- c-ares 1.29.0:\n  * When using `ARES_OPT_EVENT_THREAD`, automatically reload system configuration when network conditions change.\n    [PR #759]\n  * Apple: reimplement DNS configuration reading to more accurately pull DNS settings. [PR #750]\n  * Add observability into DNS server health via a server state callback, invoked whenever a query finishes. [PR #744]\n  * Add server failover retry behavior, where failed servers are retried with small probability after a minimum delay.\n    [PR #731]\n  * Mark `ares_channel_t *` as `const` in more places in the public API. [PR #758]\n  * Due to a logic flaw, dns name compression writing was not properly implemented which would result in the name prefix\n    not being written for a partial match. This could cause issues in various record types such as `MX` records when\n    using the deprecated API. Regression introduced in 1.28.0. [Issue #757]\n  * Revert OpenBSD `SOCK_DNS` flag, it doesn't do what the docs say it does and causes c-ares to become non-functional.\n    [PR #754]\n  * `ares_getnameinfo()`: loosen validation on `salen` parameter. [Issue #752]\n  * `cmake`: Android requires C99. [PR #748]\n  * `ares_queue_wait_empty()` does not honor `timeout_ms \u003e= 0`. [Issue #742]\n- c-ares 1.28.1:\n  * Emit warnings when deprecated c-ares functions are used. This can be disabled by passing a compiler definition of\n   `CARES_NO_DEPRECATED`. [PR #732]\n  * Add function `ares_search_dnsrec()` to search for records using the new DNS record data structures. [PR #719]\n  * Rework internals to pass around `ares_dns_record_t` instead of binary data, this introduces new public functions of\n    `ares_query_dnsrec()` and `ares_send_dnsrec()`. [PR #730]\n  * tests: when performing simulated queries, reduce timeouts to make tests run faster.\n  * Replace configuration file parsers with memory-safe parser. [PR #725]\n  * Remove `acountry` completely, the manpage might still get installed otherwise. [Issue #718]\n  * CMake: don't overwrite global required libraries/definitions/includes which could cause build errors for projects\n    chain building c-ares. [Issue #729]\n  * On some platforms, `netinet6/in6.h` is not included by `netinet/in.h` and needs to be included separately. [PR #728]\n  * Fix a potential memory leak in `ares_init()`. [Issue #724]\n  * Some platforms don't have the `isascii()` function. Implement as a macro. [PR #721]\n  * CMake: Fix chain building if `CMAKE` runtime paths not set.\n  * NDots configuration should allow a value of zero. [PR #735]\n","status":"published","published":"2026-08-31T19:41:34Z","modified":"2026-09-14T18:23:09.022091473Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:4021-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\n- CVE-2024-25629: out of bounds read in ares__read_line() (bsc#1220279).\n- CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via\n  ares_getaddrinfo() over TCP (bsc#1270416).\n- CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: Memory-amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- updated to 1.36.8.\n","status":"published","published":"2026-09-07T07:42:20Z","modified":"2026-09-13T18:23:16.109232489Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-7477-1","title":"c-ares vulnerability","description":"It was discovered that c-ares incorrectly handled re-enqueuing certain\nqueries. A remote attacker could possibly use this issue to cause c-ares to\ncrash, resulting in a denial of service.\n","status":"published","published":"2025-05-05T11:49:28.413293Z","modified":"2025-10-13T04:41:07Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}