{"id":"CVE-2025-62408","aliases":["ALPINE-CVE-2025-62408","AZL-71854","BELL-CVE-2025-62408","DEBIAN-CVE-2025-62408","DSA-6084-1","EUVD-2025-201830","GHSA-jq53-42q6-pqr5","RHSA-2026:7414","SUSE-SU-2026:21574-1","SUSE-SU-2026:21584-1","SUSE-SU-2026:23364-1","SUSE-SU-2026:23414-1","SUSE-SU-2026:4021-1","SUSE-SU-2026:4248-1","SUSE-SU-2026:4261-1","UBUNTU-CVE-2025-62408","USN-7925-1","openSUSE-SU-2026:10007-1","openSUSE-SU-2026:10029-1","openSUSE-SU-2026:20698-1"],"status":"published","title":"c-ares has a Use After Free vulnerability when connection is cleaned up after error","description":"c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5  terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00458,"percentile":0.4016,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2025-12-08T22:04:08Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"c-ares","fixed_in":["1.34.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"c-ares","fixed_in":["1.34.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"c-ares","fixed_in":["1.34.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"c-ares","fixed_in":["1.34.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"fluent-bit","fixed_in":["3.1.10-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"c-ares","fixed_in":["1.34.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"c-ares","fixed_in":["1.34.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"c-ares","fixed_in":["1.34.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"c-ares","fixed_in":["1.34.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"c-ares","fixed_in":["1.34.5-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"c-ares","fixed_in":["1.34.6-1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"c-ares","fixed_in":["0:1.34.6-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"c-ares-devel","fixed_in":["0:1.34.6-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"c-ares","fixed_in":["1.34.5-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"c-ares","fixed_in":["1.34.6-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"istioctl","fixed_in":["1.28.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.3"},{"fixed":"1.34.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.3"},{"fixed":"1.34.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.3"},{"fixed":"1.34.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.3"},{"fixed":"1.34.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"fluent-bit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.5-r0"},{"fixed":"1.34.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.1-r1"},{"fixed":"1.34.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.5-r0"},{"fixed":"1.34.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.1-r1"},{"fixed":"1.34.6-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.5-1+deb13u1"}]}],"versions":["1.34.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.6-1"}]}],"versions":["1.34.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.5-1+deb13u1"}]}],"versions":["1.34.5-1"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.6-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"c-ares-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.6-3.1.hum1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-slfo.1.1_1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-8.44.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-8.44.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.5-1ubuntu0.1"}]}],"versions":["1.34.4-2.1","1.34.5-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.5-1ubuntu0.1"}]}],"versions":["1.34.4-2.1","1.34.5-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"istioctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-1.1"}]}]}],"products":[{"vendor":"c-ares","product":"c-ares"}],"references":[{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-jq53-42q6-pqr5","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/c-ares/c-ares/commit/714bf5675c541bd1e668a8db8e67ce012651e618","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-62408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62408","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-62408","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62408.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-62408","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7414","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-62408","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7414.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2420217","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-62408","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621574-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254738","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62408","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621584-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623364-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240955","tags":["report"]},{"url":"https://bugzilla.suse.com/1270416","tags":["report"]},{"url":"https://bugzilla.suse.com/1276290","tags":["report"]},{"url":"https://bugzilla.suse.com/1276291","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623414-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264021-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220279","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25629","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264248-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236258","tags":["report"]},{"url":"https://bugzilla.suse.com/1243218","tags":["report"]},{"url":"https://bugzilla.suse.com/1243220","tags":["report"]},{"url":"https://bugzilla.suse.com/1256570","tags":["report"]},{"url":"https://bugzilla.suse.com/1256573","tags":["report"]},{"url":"https://bugzilla.suse.com/1256574","tags":["report"]},{"url":"https://bugzilla.suse.com/1256576","tags":["report"]},{"url":"https://bugzilla.suse.com/1256848","tags":["report"]},{"url":"https://bugzilla.suse.com/1259853","tags":["report"]},{"url":"https://bugzilla.suse.com/1260455","tags":["report"]},{"url":"https://bugzilla.suse.com/1260463","tags":["report"]},{"url":"https://bugzilla.suse.com/1260480","tags":["report"]},{"url":"https://bugzilla.suse.com/1260494","tags":["report"]},{"url":"https://bugzilla.suse.com/1268477","tags":["report"]},{"url":"https://bugzilla.suse.com/1268479","tags":["report"]},{"url":"https://bugzilla.suse.com/1268481","tags":["report"]},{"url":"https://bugzilla.suse.com/1268482","tags":["report"]},{"url":"https://bugzilla.suse.com/1268555","tags":["report"]},{"url":"https://bugzilla.suse.com/1268592","tags":["report"]},{"url":"https://bugzilla.suse.com/1268593","tags":["report"]},{"url":"https://bugzilla.suse.com/1268605","tags":["report"]},{"url":"https://bugzilla.suse.com/1268606","tags":["report"]},{"url":"https://bugzilla.suse.com/1268608","tags":["report"]},{"url":"https://bugzilla.suse.com/1268609","tags":["report"]},{"url":"https://bugzilla.suse.com/1268611","tags":["report"]},{"url":"https://bugzilla.suse.com/1268618","tags":["report"]},{"url":"https://bugzilla.suse.com/1269825","tags":["report"]},{"url":"https://bugzilla.suse.com/1272941","tags":["report"]},{"url":"https://bugzilla.suse.com/1272942","tags":["report"]},{"url":"https://bugzilla.suse.com/1272943","tags":["report"]},{"url":"https://bugzilla.suse.com/1272944","tags":["report"]},{"url":"https://bugzilla.suse.com/1272945","tags":["report"]},{"url":"https://bugzilla.suse.com/1272947","tags":["report"]},{"url":"https://bugzilla.suse.com/1272948","tags":["report"]},{"url":"https://bugzilla.suse.com/1272951","tags":["report"]},{"url":"https://bugzilla.suse.com/1272958","tags":["report"]},{"url":"https://bugzilla.suse.com/1273591","tags":["report"]},{"url":"https://bugzilla.suse.com/1273593","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264261-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-62408","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7925-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-62408","title":"c-ares has a Use After Free vulnerability when connection is cleaned up after error","description":"c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5  terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.","status":"published","published":"2025-12-08T22:04:08.565Z","modified":"2025-12-09T16:05:06.098Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:32:54.87586Z"}],"euvd":[{"id":"EUVD-2025-201830","description":"c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5  terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.","status":"published","published":"2025-12-08T22:04:08Z","modified":"2025-12-09T16:05:06Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:08.049254Z"}],"nvd":[{"id":"CVE-2025-62408","description":"c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5  terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.","status":"published","published":"2025-12-08T22:15:52.62Z","modified":"2026-10-14T22:10:00.21Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:11:49.093461Z"}],"osv":[{"id":"ALPINE-CVE-2025-62408","description":"c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5  terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.","status":"published","published":"2025-12-08T22:15:52.62Z","modified":"2026-08-27T22:18:02.997249718Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-62408","status":"published","published":"2025-12-10T06:08:31.791472Z","modified":"2026-02-18T07:38:16.201705Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-62408","title":"c-ares has a Use After Free vulnerability when connection is cleaned up after error","description":"c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5  terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.","status":"published","published":"2025-12-08T22:04:08.565Z","modified":"2026-10-28T10:45:41.036643578Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"DEBIAN-CVE-2025-62408","description":"c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5  terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.","status":"published","published":"2025-12-08T22:15:52.62Z","modified":"2026-10-15T09:47:28.364147038Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"RHSA-2026:7414","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:54Z","modified":"2026-10-06T10:31:19.190283373Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2025-62408","description":"c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.","status":"published","published":"2025-12-08T22:15:00Z","modified":"2026-04-22T16:08:28.114295Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"AZL-71854","title":"CVE-2025-62408 affecting package fluent-bit for versions less than 3.1.10-4","description":"c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5  terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.","status":"published","published":"2025-12-08T22:15:52Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.309973Z"},{"id":"DSA-6084-1","title":"c-ares - security update","status":"published","published":"2025-12-18T00:00:00Z","modified":"2025-12-18T14:29:58.784585Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"openSUSE-SU-2026:10007-1","title":"c-ares-devel-1.34.6-1.1 on GA media","description":"These are all security issues fixed in the c-ares-devel-1.34.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-06T00:00:00Z","modified":"2026-03-23T04:54:19.800557Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10029-1","title":"istioctl-1.28.2-1.1 on GA media","description":"These are all security issues fixed in the istioctl-1.28.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-12T00:00:00Z","modified":"2026-03-23T04:54:21.672778Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20698-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issue\n\n- CVE-2025-62408: use after free in read_answers() (bsc#1254738).\n\nChanges for c-ares:\n\n- c-ares 1.35.6:\n * Ignore Windows IDN Search Domains until proper IDN support is\n added\n * Various bug fixes\n","status":"published","published":"2026-05-07T09:37:18Z","modified":"2026-05-09T18:24:56.451386Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21574-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issue\n\n- CVE-2025-62408: use after free in read_answers() (bsc#1254738).\n\nChanges for c-ares:\n\n- c-ares 1.35.6:\n * Ignore Windows IDN Search Domains until proper IDN support is\n added\n * Various bug fixes\n","status":"published","published":"2026-05-07T09:36:51Z","modified":"2026-05-12T18:27:49.075235Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21584-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issue\n\n- CVE-2025-62408: use after free in read_answers() (bsc#1254738).\n\nChanges for c-ares:\n\n- c-ares 1.35.6:\n * Ignore Windows IDN Search Domains until proper IDN support is\n added\n * Various bug fixes\n","status":"published","published":"2026-05-07T09:36:51Z","modified":"2026-05-16T18:24:15.504226Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:23364-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdate to c-ares 1.34.8.\n\n- CVE-2025-31498: use-after-free in `read_answers()` when `process_answer()` may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- c-ares 1.34.8:\n  * For details, see https://c-ares.org/changelog.html.\n- c-ares 1.34.6:\n  * Ignore Windows IDN Search Domains until proper IDN support is added.\n  * Various bug fixes.\n- c-ares 1.34.4:\n  * Changes:\n    -  QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938\n  * Bugfixes:\n    - Empty TXT records were not being preserved. PR #922\n    - `docs`: update deprecation notices for `ares_create_query()` and `ares_mkquery()`. PR #910\n    - `license`: some files weren't properly updated. PR #920\n    - Fix `bind` local device regression from 1.34.0. PR #929, PR #931, PR #935\n    - `CMake`: set policy version to prevent deprecation warnings. PR #932\n    - `CMake`: shared and static library names should be the same on unix platforms like `autotools` uses. PR #933\n    - Update to latest `autoconf` archive macros for enhanced system compatibility. PR #936\n- c-ares 1.34.3:\n  * Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906\n  * Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911\n  * TSAN warns on missing lock, but lock isn't actually necessary. PR #915\n  * `ares_getaddrinfo(`) for `AF_UNSPEC` should retry IPv4 if only IPv6 is received. 765d558\n  * `ares_send()` shouldn't return `ARES_EBADRESP`, its `ARES_EBADQUERY`. 91519e7\n  * Fix typos in man pages. PR #905\n- c-ares 1.34.2:\n  * Features:\n    - `adig`: read arguments from `adigrc`. [PR #856]\n    - Add new pending write callback optimization via `ares_set_pending_write_cb`. [PR #857]\n    - New function `ares_process_fds()`. [PR #875]\n    - Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]\n    - `adig`: rework command line arguments to mimic `dig` from `bind`. [PR #890]\n    - Add new method for overriding network functions `ares_set_socket_function_ex()` to properly support all new\n      functionality. [PR #894]\n    - Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]\n    - `ares_socket`: set `IP_BIND_ADDRESS_NO_PORT` on `ares_set_local_ip*` tcp sockets [PR #887]\n    - URI parser/writer for `ares_set_servers_csv()`/`ares_get_servers_csv()`. [PR #882]\n    - Connection handling modularization. [PR #857], [PR #876]\n    - Expose library/utility functions to tools. [PR #860]\n    - Remove `ares__` prefix, just use `ares_` for internal functions. [PR #872]\n    - fix: potential `WIN32_LEAN_AND_MEAN` redefinition. [PR #869]\n    - Fix `googletest` v1.15 compatibility. [PR #874]\n    - Fix `pkgconfig` thread dependencies. [PR #884]\n- c-ares 1.33.0:\n  * Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]\n  * Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]\n  * Reorganize source tree. [PR #822]\n  * Refactoring of connection handling to prevent code duplication. [PR #839]\n  * New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]\n  * `ares_destroy()` race condition during shutdown due to missing lock. [PR #831]\n- c-ares in 1.32:\n  * Add support for DNS `0x20` to help prevent cache poisoning attacks, enabled by specifying `ARES_FLAG_DNS0x20`.\n    Disabled by default. [PR #800]\n  * Rework query timeout logic to automatically adjust timeouts based on network conditions. The timeout specified now\n    is only used as a hint until there is enough history to calculate a more valid timeout. [PR #794]\n  * DNS RR `TXT` strings should not be automatically concatenated as there are use cases outside of RFC 7208. In order\n    to maintain ABI compliance, the ability to retrieve `TXT` strings concatenated is retained as well as a new API to\n    retrieve the individual strings. This restores behavior from c-ares 1.20.0. [PR #801]\n  * Clean up header inclusion logic to make hacking on code easier. [PR #797]\n  * GCC/Clang: Enable even more strict warnings to catch more coding flaws. [253bdee]\n  * Tests: Fix thread race condition in test cases for `EventThread`. [PR #803]\n  * Thread Saftey: `ares_timeout()` was missing lock. [74a64e4]\n- c-ares 1.31.0:\n  * Enable Query Cache by default. [PR #786]\n  * Enhance Windows DNS configuration change detection to also detect manual DNS configuration changes. [PR #785]\n  * Various legacy MacOS Build fixes. [Issue #782]\n  * Ndots value of zero in `resolv.conf` was not being honored. [852a60a]\n  * Watt-32 build support had been broken for some time. [PR #781]\n  * Distribute `ares_dns_rec_type_tostr` manpage. [PR #778]\n- c-ares 1.30.0:\n  * Basic support for SIG RR record (RFC 2931 / RFC 2535) [PR #773]\n  * Validation that DNS strings can only consist of printable ascii characters otherwise will trigger a parse failure.\n    [75de16c] and [40fb125]\n  * `QueryCache`: Fix issue where purging on server changes wasn't working. [a6c8fe6]\n- c-ares 1.29.0:\n  * When using `ARES_OPT_EVENT_THREAD`, automatically reload system configuration when network conditions change.\n    [PR #759]\n  * Apple: reimplement DNS configuration reading to more accurately pull DNS settings. [PR #750]\n  * Add observability into DNS server health via a server state callback, invoked whenever a query finishes. [PR #744]\n  * Add server failover retry behavior, where failed servers are retried with small probability after a minimum delay.\n    [PR #731]\n  * Mark `ares_channel_t *` as `const` in more places in the public API. [PR #758]\n  * Due to a logic flaw, dns name compression writing was not properly implemented which would result in the name prefix\n    not being written for a partial match. This could cause issues in various record types such as `MX` records when\n    using the deprecated API. Regression introduced in 1.28.0. [Issue #757]\n  * Revert OpenBSD `SOCK_DNS` flag, it doesn't do what the docs say it does and causes c-ares to become non-functional.\n    [PR #754]\n  * `ares_getnameinfo()`: loosen validation on `salen` parameter. [Issue #752]\n  * `cmake`: Android requires C99. [PR #748]\n  * `ares_queue_wait_empty()` does not honor `timeout_ms \u003e= 0`. [Issue #742]\n- c-ares 1.28.1:\n  * Emit warnings when deprecated c-ares functions are used. This can be disabled by passing a compiler definition of\n   `CARES_NO_DEPRECATED`. [PR #732]\n  * Add function `ares_search_dnsrec()` to search for records using the new DNS record data structures. [PR #719]\n  * Rework internals to pass around `ares_dns_record_t` instead of binary data, this introduces new public functions of\n    `ares_query_dnsrec()` and `ares_send_dnsrec()`. [PR #730]\n  * tests: when performing simulated queries, reduce timeouts to make tests run faster.\n  * Replace configuration file parsers with memory-safe parser. [PR #725]\n  * Remove `acountry` completely, the manpage might still get installed otherwise. [Issue #718]\n  * CMake: don't overwrite global required libraries/definitions/includes which could cause build errors for projects\n    chain building c-ares. [Issue #729]\n  * On some platforms, `netinet6/in6.h` is not included by `netinet/in.h` and needs to be included separately. [PR #728]\n  * Fix a potential memory leak in `ares_init()`. [Issue #724]\n  * Some platforms don't have the `isascii()` function. Implement as a macro. [PR #721]\n  * CMake: Fix chain building if `CMAKE` runtime paths not set.\n  * NDots configuration should allow a value of zero. [PR #735]\n","status":"published","published":"2026-08-28T11:28:12Z","modified":"2026-09-10T18:23:13.347908946Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23414-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdate to c-ares 1.34.8.\n\n- CVE-2025-31498: use-after-free in `read_answers()` when `process_answer()` may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- c-ares 1.34.8:\n  * For details, see https://c-ares.org/changelog.html.\n- c-ares 1.34.6:\n  * Ignore Windows IDN Search Domains until proper IDN support is added.\n  * Various bug fixes.\n- c-ares 1.34.4:\n  * Changes:\n    -  QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938\n  * Bugfixes:\n    - Empty TXT records were not being preserved. PR #922\n    - `docs`: update deprecation notices for `ares_create_query()` and `ares_mkquery()`. PR #910\n    - `license`: some files weren't properly updated. PR #920\n    - Fix `bind` local device regression from 1.34.0. PR #929, PR #931, PR #935\n    - `CMake`: set policy version to prevent deprecation warnings. PR #932\n    - `CMake`: shared and static library names should be the same on unix platforms like `autotools` uses. PR #933\n    - Update to latest `autoconf` archive macros for enhanced system compatibility. PR #936\n- c-ares 1.34.3:\n  * Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906\n  * Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911\n  * TSAN warns on missing lock, but lock isn't actually necessary. PR #915\n  * `ares_getaddrinfo(`) for `AF_UNSPEC` should retry IPv4 if only IPv6 is received. 765d558\n  * `ares_send()` shouldn't return `ARES_EBADRESP`, its `ARES_EBADQUERY`. 91519e7\n  * Fix typos in man pages. PR #905\n- c-ares 1.34.2:\n  * Features:\n    - `adig`: read arguments from `adigrc`. [PR #856]\n    - Add new pending write callback optimization via `ares_set_pending_write_cb`. [PR #857]\n    - New function `ares_process_fds()`. [PR #875]\n    - Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]\n    - `adig`: rework command line arguments to mimic `dig` from `bind`. [PR #890]\n    - Add new method for overriding network functions `ares_set_socket_function_ex()` to properly support all new\n      functionality. [PR #894]\n    - Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]\n    - `ares_socket`: set `IP_BIND_ADDRESS_NO_PORT` on `ares_set_local_ip*` tcp sockets [PR #887]\n    - URI parser/writer for `ares_set_servers_csv()`/`ares_get_servers_csv()`. [PR #882]\n    - Connection handling modularization. [PR #857], [PR #876]\n    - Expose library/utility functions to tools. [PR #860]\n    - Remove `ares__` prefix, just use `ares_` for internal functions. [PR #872]\n    - fix: potential `WIN32_LEAN_AND_MEAN` redefinition. [PR #869]\n    - Fix `googletest` v1.15 compatibility. [PR #874]\n    - Fix `pkgconfig` thread dependencies. [PR #884]\n- c-ares 1.33.0:\n  * Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]\n  * Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]\n  * Reorganize source tree. [PR #822]\n  * Refactoring of connection handling to prevent code duplication. [PR #839]\n  * New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]\n  * `ares_destroy()` race condition during shutdown due to missing lock. [PR #831]\n- c-ares in 1.32:\n  * Add support for DNS `0x20` to help prevent cache poisoning attacks, enabled by specifying `ARES_FLAG_DNS0x20`.\n    Disabled by default. [PR #800]\n  * Rework query timeout logic to automatically adjust timeouts based on network conditions. The timeout specified now\n    is only used as a hint until there is enough history to calculate a more valid timeout. [PR #794]\n  * DNS RR `TXT` strings should not be automatically concatenated as there are use cases outside of RFC 7208. In order\n    to maintain ABI compliance, the ability to retrieve `TXT` strings concatenated is retained as well as a new API to\n    retrieve the individual strings. This restores behavior from c-ares 1.20.0. [PR #801]\n  * Clean up header inclusion logic to make hacking on code easier. [PR #797]\n  * GCC/Clang: Enable even more strict warnings to catch more coding flaws. [253bdee]\n  * Tests: Fix thread race condition in test cases for `EventThread`. [PR #803]\n  * Thread Saftey: `ares_timeout()` was missing lock. [74a64e4]\n- c-ares 1.31.0:\n  * Enable Query Cache by default. [PR #786]\n  * Enhance Windows DNS configuration change detection to also detect manual DNS configuration changes. [PR #785]\n  * Various legacy MacOS Build fixes. [Issue #782]\n  * Ndots value of zero in `resolv.conf` was not being honored. [852a60a]\n  * Watt-32 build support had been broken for some time. [PR #781]\n  * Distribute `ares_dns_rec_type_tostr` manpage. [PR #778]\n- c-ares 1.30.0:\n  * Basic support for SIG RR record (RFC 2931 / RFC 2535) [PR #773]\n  * Validation that DNS strings can only consist of printable ascii characters otherwise will trigger a parse failure.\n    [75de16c] and [40fb125]\n  * `QueryCache`: Fix issue where purging on server changes wasn't working. [a6c8fe6]\n- c-ares 1.29.0:\n  * When using `ARES_OPT_EVENT_THREAD`, automatically reload system configuration when network conditions change.\n    [PR #759]\n  * Apple: reimplement DNS configuration reading to more accurately pull DNS settings. [PR #750]\n  * Add observability into DNS server health via a server state callback, invoked whenever a query finishes. [PR #744]\n  * Add server failover retry behavior, where failed servers are retried with small probability after a minimum delay.\n    [PR #731]\n  * Mark `ares_channel_t *` as `const` in more places in the public API. [PR #758]\n  * Due to a logic flaw, dns name compression writing was not properly implemented which would result in the name prefix\n    not being written for a partial match. This could cause issues in various record types such as `MX` records when\n    using the deprecated API. Regression introduced in 1.28.0. [Issue #757]\n  * Revert OpenBSD `SOCK_DNS` flag, it doesn't do what the docs say it does and causes c-ares to become non-functional.\n    [PR #754]\n  * `ares_getnameinfo()`: loosen validation on `salen` parameter. [Issue #752]\n  * `cmake`: Android requires C99. [PR #748]\n  * `ares_queue_wait_empty()` does not honor `timeout_ms \u003e= 0`. [Issue #742]\n- c-ares 1.28.1:\n  * Emit warnings when deprecated c-ares functions are used. This can be disabled by passing a compiler definition of\n   `CARES_NO_DEPRECATED`. [PR #732]\n  * Add function `ares_search_dnsrec()` to search for records using the new DNS record data structures. [PR #719]\n  * Rework internals to pass around `ares_dns_record_t` instead of binary data, this introduces new public functions of\n    `ares_query_dnsrec()` and `ares_send_dnsrec()`. [PR #730]\n  * tests: when performing simulated queries, reduce timeouts to make tests run faster.\n  * Replace configuration file parsers with memory-safe parser. [PR #725]\n  * Remove `acountry` completely, the manpage might still get installed otherwise. [Issue #718]\n  * CMake: don't overwrite global required libraries/definitions/includes which could cause build errors for projects\n    chain building c-ares. [Issue #729]\n  * On some platforms, `netinet6/in6.h` is not included by `netinet/in.h` and needs to be included separately. [PR #728]\n  * Fix a potential memory leak in `ares_init()`. [Issue #724]\n  * Some platforms don't have the `isascii()` function. Implement as a macro. [PR #721]\n  * CMake: Fix chain building if `CMAKE` runtime paths not set.\n  * NDots configuration should allow a value of zero. [PR #735]\n","status":"published","published":"2026-08-31T19:41:34Z","modified":"2026-09-14T18:23:09.022091473Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:4021-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\n- CVE-2024-25629: out of bounds read in ares__read_line() (bsc#1220279).\n- CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via\n  ares_getaddrinfo() over TCP (bsc#1270416).\n- CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: Memory-amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- updated to 1.36.8.\n","status":"published","published":"2026-09-07T07:42:20Z","modified":"2026-09-13T18:23:16.109232489Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4248-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request\n  (bsc#1236258).\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous\n  operations and lead to exposure of in-process secrets (bsc#1256570).\n- CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error\n  (bsc#1256573).\n- CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is enabled can\n  lead to crash (bsc#1256574).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the\n  Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).\n\nChanges for nodejs18:\n \n- upgraded embedded undici to 6.28.0.\n- upgraded embedded nghttp2 to 1.69.0.\n","status":"published","published":"2026-09-17T15:59:50Z","modified":"2026-09-18T10:00:04.762818452Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4261-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request\n  (bsc#1236258).\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous\n  operations and lead to exposure of in-process secrets (bsc#1256570).\n- CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error\n  (bsc#1256573).\n- CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is enabled can\n  lead to crash (bsc#1256574).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the\n  Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).\n\nChanges for nodejs18:\n \n- upgraded embedded undici to 6.28.0.\n- upgraded embedded nghttp2 to 1.69.0.\n","status":"published","published":"2026-09-18T07:44:28Z","modified":"2026-09-18T18:00:04.233169266Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-7925-1","title":"c-ares vulnerability","description":"It was discovered that c-ares incorrectly handled terminating certain\nqueries after a maximum number of attempts. An attacker could possibly use\nthis issue to cause c-ares to crash, resulting in a denial of service.","status":"published","published":"2025-12-11T13:07:40Z","modified":"2026-04-22T11:03:56.04113Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}