c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/c-ares/c-ares/commit/714bf5675c541bd1e668a8db8e67ce012651e618 Patch
- https://github.com/c-ares/c-ares/security/advisories/GHSA-jq53-42q6-pqr5 Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.9 · c-aresNVD modified 2026-10-14 22:10
Affected (CPE criteria) 1
cpe:2.3:a:c-ares:c-ares:*:*:*:*:*:*:*:*