Vendors / c-ares Records 14 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 5
Exploited now c-ares records in CISA KEV No c-ares vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 60
Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.
CVSS 3.1 MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00977 · Published 2023-08-22 · Partial fix CWE-125
Priority MEDIUM 53
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with a…
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08653 · Published 2016-10-03 · Partial fix CWE-787
Priority LOW 39
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particu…
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.03337 · Published 2017-07-07 · Partial fix CWE-200
Priority LOW 27
c-ares is an asynchronous resolver library.
CVSS 3.1 MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00427 · Published 2025-12-08 · Partial fix CWE-416
Priority LOW 25
c-ares is a C library for asynchronous DNS requests.
CVSS 3.1 MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00352 · Published 2024-02-23 · Partial fix · 1.27.0 CWE-127
Priority LOW 17
A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing.
CVSS 3.1 LOW 3.3· Local · Low privileges · No interaction · EPSS 0.00529 · Published 2021-05-13 · No fix listed CWE-120
Open these records in search → All records by CVSS severity
1 5 6 2 0
THREATIST.IORead the docs