Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2025-62408

c-ares has a Use After Free vulnerability when connection is cleaned up after error

Description

c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

c-ares c-ares

  • > 1.32.3, < 1.34.6affected

References