Read the docs
TI-2025-22678 Aliases CVE-2025-31498

c-ares has a use-after-free in read_answers()

Priority LOW 37CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Partial Red Hat: 4 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00602 49th percentileScored 2026-11-07
Fix Partial c-ares (c-ares): 1.34.5Red Hat: 6 advisoriesRed Hat: 4 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
c-aresc-ares1.32.3 to before 1.34.51.34.5Patch availableCNA
  • c-ares Vendorc-ares Affected 1.32.3 to before 1.34.5 Fixed in 1.34.5 Patch available CNA

Remediation

  • Fix · CNA c-ares (c-ares) Fixed in 1.34.5

Red Hat 6 advisories

  • RHSA-2025:7537 Released 2025-05-14 · Red Hat rating Moderate
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) nodejs-1:20.18.2-2.module+el9.4.0+23089+aaa18a20.aarch64::nodejs:20, nodejs-1:20.18.2-2.module+el9.4.0+23089+aaa18a20.ppc64le::nodejs:20, nodejs-1:20.18.2-2.module+el9.4.0+23089+aaa18a20.s390x::nodejs:20 +20
  • RHSA-2025:7502 Released 2025-05-13 · Red Hat rating Moderate
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.15.0-1.el10_0, nodejs-devel-1:22.15.0-1.el10_0, nodejs-docs-1:22.15.0-1.el10_0 +4
  • RHSA-2025:7433 Released 2025-05-13 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.15.0-1.module+el9.6.0+23062+9e7801b9.aarch64::nodejs:22, nodejs-1:22.15.0-1.module+el9.6.0+23062+9e7801b9.ppc64le::nodejs:22, nodejs-1:22.15.0-1.module+el9.6.0+23062+9e7801b9.s390x::nodejs:22 +28
Show 3 more Red Hat advisories
  • RHSA-2025:7426 Released 2025-05-13 · Red Hat rating Moderate
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:20.19.1-1.module+el9.6.0+23053+4195b0b2.aarch64::nodejs:20, nodejs-1:20.19.1-1.module+el9.6.0+23053+4195b0b2.ppc64le::nodejs:20, nodejs-1:20.19.1-1.module+el9.6.0+23053+4195b0b2.s390x::nodejs:20 +20
  • RHSA-2025:4461 Released 2025-05-05 · Red Hat rating Moderate
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:20.19.1-1.module+el8.10.0+23054+5431297f.aarch64::nodejs:20, nodejs-1:20.19.1-1.module+el8.10.0+23054+5431297f.ppc64le::nodejs:20, nodejs-1:20.19.1-1.module+el8.10.0+23054+5431297f.s390x::nodejs:20 +20
  • RHSA-2025:4459 Released 2025-05-05 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.15.0-1.module+el8.10.0+23068+28ff2340.aarch64::nodejs:22, nodejs-1:22.15.0-1.module+el8.10.0+23068+28ff2340.ppc64le::nodejs:22, nodejs-1:22.15.0-1.module+el8.10.0+23068+28ff2340.s390x::nodejs:22 +28

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:7502
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:4459, RHSA-2025:4461
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:7426, RHSA-2025:7433
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:7537
Not affected: 4 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-31498

References

Other 3

  • TI-2026-48538 c-ares: Memory-amplification denial of service via unvalidated DNS header record counts CVSS 3.1MEDIUM 5.3
  • TI-2020-14305 Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function… CVSS 3.1MEDIUM 5.9
  • TI-2016-04481 Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0… CVSS 3.1CRITICAL 9.8
  • TI-2023-15371 0-byte UDP payload DoS in c-ares CVSS 3.1HIGH 7.5
  • TI-2026-26011 Double free in c-ares CVSS 3.1HIGH 7.5
  • TI-2026-48536 c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences