AZL-13817 CVE-2022-4904 affecting package c-ares for versions less than 1.19.0-1

🗓️ 06 Mar 2023 23:15:11Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Flaw in c-ares before 1.19.0-1 allows stack overflow via ares_set_sortlist input, risking denial of service.

Reporter	Title	Published	Views	Family All 249
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	7 Jun 202316:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service and arbitrary code execution due to [CVE-2022-4904], [CVE-2023-32067]	28 Jul 202314:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	15 Apr 202503:57	–	ibm
Tenable Nessus	Amazon Linux 2023 : c-ares, c-ares-devel (ALAS2023-2023-198)	8 Jun 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-243)	20 Jul 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : c-ares (ALAS-2024-2399)	9 Jan 202400:00	–	nessus
Tenable Nessus	Amazon Linux AMI : c-ares (ALAS-2023-1780)	20 Jul 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0037: nodejs:14 (ALINUX3-SA-2023:0037)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : nodejs:18 (ALSA-2023:2654)	13 May 202300:00	–	nessus
Tenable Nessus	AlmaLinux 9 : nodejs and nodejs-nodemon (ALSA-2023:2655)	14 May 202300:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-4904

21 Apr 2026 04:23Current

7.1High risk

Vulners AI Score7.1

CVSS 3.18.6

EPSS0.01232