SB2026102037 - Multiple vulnerabilities in c-ares

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102037

SB2026102037 - Multiple vulnerabilities in c-ares

Published: October 20, 2026

Security Bulletin ID SB2026102037
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 70% Low 30%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to potentially disclose sensitive information and cause applications to use incorrect network addresses.

The vulnerability exists due to use of uninitialized stack memory in c-ares when parsing numeric IPv6 names containing a prefix length. A remote attacker can supply a crafted name such as ::1/0 to cause ares_inet_pton() to report success after initializing only the bytes covered by the prefix, allowing ares_getaddrinfo() or ares_gethostbyname() to return an address containing uninitialized stack data.

The crafted names cannot originate from a DNS reply.


2) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to corrupt memory and cause a denial of service.

The vulnerability exists due to improper synchronization in c-ares ares_save_options(), also used by ares_dup(), when copying channel configuration while another thread changes it. A local user can trigger concurrent configuration changes and option copying to cause writes past a buffer sized for the previous server list or access settings freed during copying, resulting in memory corruption and a denial of service.


3) Insufficient verification of data authenticity (CVE-ID: N/A)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to poison DNS caches and manipulate DNS server selection.

The vulnerability exists due to insufficient verification of data authenticity in c-ares DNS reply handling when matching replies to outstanding queries without checking that they arrived on the connection used to send the query. A remote attacker can spoof replies matching a query ID and question on another open connection, or control a configured DNS server, to inject responses for queries sent to another server, bypass that server's DNS cookies, and use forged errors to steer queries away from a healthy server.

Exploitation affects applications with more than one DNS server configured.


4) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service by crashing an application using c-ares.

The vulnerability exists due to use-after-free in c-ares connection handling when a socket-state callback cancels lookups or reconfigures servers while a connection is being opened. A local user can trigger an ordinary lookup in an application with this callback behavior to cause the connection to be released before c-ares finishes using it, resulting in a process crash.


5) Use of Incorrectly-Resolved Name or Reference (CVE-ID: N/A)

CWE-ID: CWE-706 - Use of Incorrectly-Resolved Name or Reference

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause an application to receive DNS answers inconsistent with its requested EDNS options.

The vulnerability exists due to omission of EDNS options from cache keys in the c-ares query cache when processing otherwise identical DNS lookups with different EDNS options. A remote attacker can exploit reuse of a cached answer across these lookups to cause an application to receive an answer lacking requested DNSSEC records or generated for a different EDNS Client Subnet.

The affected usage is applications submitting their own requests through ares_send_dnsrec() with varying EDNS options on one channel. The ares_getaddrinfo(), ares_query(), ares_search() and similar interfaces are not affected.


6) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing an application using c-ares.

The vulnerability exists due to use-after-free in c-ares lookup handling when a failed lookup send causes connection shutdown and another pending lookup's callback calls ares_cancel(), releasing the original lookup while it is still in use. A remote attacker can trigger this sequence in an application with multiple lookups in flight to crash the process and cause a denial of service.


7) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing an application using c-ares.

The vulnerability exists due to use-after-free in the c-ares lookup cancellation and channel destruction handling when application callbacks reconfigure servers or start a new lookup whose send fails. Cancelled lookups remain reachable through internal tracking during callback execution, allowing the same lookup to be completed twice. A remote attacker can trigger this condition in an affected application to cause access to freed memory and crash the process.


8) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing an application using c-ares.

The vulnerability exists due to use-after-free in c-ares server-record handling when an application changes its DNS server list from within a query callback. A remote attacker can send a specially crafted DNS error reply to help trigger access to a released server record when a lookup is requeued, causing the application to crash.


9) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing an application using c-ares.

The vulnerability exists due to use-after-free in the c-ares query cache when a completion callback reconfigures servers or starts another lookup, causing the cached answer to be freed before the callback finishes reading it. A remote attacker can trigger this sequence in an affected application to cause a denial of service through a process crash.


10) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing an application using c-ares.

The vulnerability exists due to use-after-free in c-ares lookup handling when an application cancels lookups or reconfigures servers from within a server-state callback registered through ares_set_server_state_callback(). A remote attacker can trigger a lookup timeout or an error reply such as SERVFAIL to invoke the callback, causing c-ares to continue accessing freed lookup or server memory and crash the process.


Remediation

Install update from vendor's website.

References