Lucene search

K
cvelistGitHub_MCVELIST:CVE-2023-32067
HistoryMay 25, 2023 - 10:49 p.m.

CVE-2023-32067 0-byte UDP payload DoS in c-ares

2023-05-2522:49:55
CWE-400
GitHub_M
raw.githubusercontent.com
c-ares asynchronous resolver udp denial of service patched

6.2 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

34.6%

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.