c-ares vulnerabilities

CVEs whose affected-version data names the c-ares package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

3 CVEsRSS

CVE-2026-69186Medium· 5.3PoC⚖ disputed

1mo ago

c-ares is an asynchronous resolver library

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Beca…

▾ Twilightc-ares · c-aresEPSS 0.47%via NVD

CVE-2026-69184High· 7.5

1mo ago

c-ares is an asynchronous resolver library

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response …

▾ Twilightc-ares · c-aresEPSS 0.48%via NVD

CVE-2025-62408Medium· 5.9

10mo ago

c-ares is an asynchronous resolver library

c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

▾ Sunlitc-ares · c-aresEPSS 0.43%via NVD