Advisories · Technology
c-ares.
Every CVE that names c-ares among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
- c-ares
- Denial of service
- CVSS 5.3 Medium
c-ares: Memory-amplification denial of service via unvalidated DNS header record counts
- c-ares
- Denial of service
- CVSS 7.5 High
c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP
- c-ares
- Memory corruption
- CVSS 5.9 Medium
c-ares has a Use After Free vulnerability when connection is cleaned up after error
- c-ares
- Memory corruption
- CVSS 8.3 High
c-ares has a use-after-free in read_answers()
- c-ares
- Memory corruption
- CVSS 4.4 Medium
c-ares out of bounds read in ares__read_line()
- c-ares
- CWE-127
- CVSS 7.5 High
0-byte UDP payload DoS in c-ares
- c-ares
- Denial of service
- CVSS 5.9 Medium
Insufficient randomness in generation of DNS query IDs in c-ares
- c-ares
- Weak cryptography or TLS
- CVSS 4.1 Medium
Buffer Underwrite in ares_inet_net_pton()
- c-ares
- Memory corruption
- CVSS 3.7 Low
AutoTools does not set CARES_RANDOM_FILE during cross compilation
- c-ares
- Weak cryptography or TLS
- CVSS 8.6 High
Improper input validation in c-ares
- c-ares
- CWE-20
-
Cross-site scripting in c-ares
- c-ares
- Cross-site scripting (XSS)
-
Buffer overflow in c-ares
- c-ares
- Memory corruption