c-ares has 3 CVEs on record between 2025 and 2026. 2 were published in the last 90 days. The median CVSS is 5.9 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.9
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Weakness classes
Products
- c-ares 3
c-ares vulnerabilities
CVEs affecting c-ares, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-69186Medium· 5.3PoC⚖ disputedc-ares is an asynchronous resolver library
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Beca…
CVE-2026-69184High· 7.5c-ares is an asynchronous resolver library
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response …
CVE-2025-62408Medium· 5.9c-ares is an asynchronous resolver library
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.