CVE-2025-62408 — Use After Free in C-ares

CWE-416 — Use After Free8 documents8 sources
Severity
5.9MEDIUMNVD
EPSS
0.0%
top 91.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
C-ares
Timeline
PublishedDec 8
Latest updateDec 11

Description

c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages3 packages

▶NVDc-ares/c-ares1.32.3 — 1.34.6
▶Debianc-ares/c-ares< 1.34.5-1+deb13u1+1
▶CVEListV5c-ares/c-ares> 1.32.3, < 1.34.6

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
CVEList
c-ares has a Use After Free vulnerability when connection is cleaned up after error↗2025-12-08
▶
OSV
CVE-2025-62408: c-ares is an asynchronous resolver library↗2025-12-08
▶

📋Vendor Advisories

4
Ubuntu
c-ares vulnerability↗2025-12-11
▶
Microsoft
c-ares has a Use After Free vulnerability when connection is cleaned up after error↗2025-12-09
▶
Red Hat
c-ares: c-ares: Denial of Service due to query termination after maximum attempts↗2025-12-08
▶
Debian
CVE-2025-62408: c-ares - c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 term...↗2025
▶

💬Community

1
Bugzilla
CVE-2025-62408 c-ares: c-ares: Denial of Service due to query termination after maximum attempts↗2025-12-08
▶