Ubuntu 24.10 / 25.04 : c-ares vulnerability (USN-7477-1)

The remote Ubuntu 24.10 / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7477-1 advisory. It was discovered that c-ares incorrectly handled re-enqueuing certain queries. A remote attacker could possibly use this issue to cause c-ares to crash,...

RHEL 8 : nodejs:20 (RHSA-2025:4461)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4461 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes...

ALSA-2025:4461 Moderate: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: c-ares: c-ares has a use-after-free in readanswers CVE-2025-31498 For more details about the security issues, including the impact, a CVSS score,...

ALSA-2025:4459 Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: c-ares: c-ares has a use-after-free in readanswers CVE-2025-31498 SQLite: integer overflow in SQLite CVE-2025-3277 For more details about the...

Medium: nodejs20

Issue Overview: c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in readanswers when processanswer may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if t...

Medium: nodejs20

Issue Overview: c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in readanswers when processanswer may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if t...

Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2025-942)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-942 advisory. c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in readanswers when processanswer may re-enqueue a query either due to a DNS Cookie Failure or when the...

[SECURITY] Fedora 40 Update: c-ares-1.34.5-1.fc40

c-ares is a C library that performs DNS requests and name resolves asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT...

c-ares Installed (macOS)

Binary data macosc-aresinstalled.nbin...

c-ares 1.32.3 < 1.34.5 Use After Free (macOS)

The version of c-ares installed on the remote host is affected by a use after free vulnerability. c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in readanswers when processanswer may re-enqueue a query either due to a DNS Cookie Failure or when t...

Fedora 40 : c-ares (2025-942a0d7e5d)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-942a0d7e5d advisory. Update to 1.34.5. Fixes CVE-2025-31498. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus ha...

Fedora: Security Advisory (FEDORA-2025-942a0d7e5d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the C-ares asynchronous DNS query library, related to the possibility of using memory after it is freed, allows a hacker to cause a service failure.

The vulnerability of the C-ares asynchronous DNS query library is related to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

[SECURITY] Fedora 41 Update: c-ares-1.34.5-1.fc41

c-ares is a C library that performs DNS requests and name resolves asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT...

Fedora 41 : c-ares (2025-c26ac54608)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-c26ac54608 advisory. Update to 1.34.5. Fixes CVE-2025-31498. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus ha...

c-ares has a use-after-free in read_answers()

...

[SECURITY] Fedora 42 Update: c-ares-1.34.5-1.fc42

c-ares is a C library that performs DNS requests and name resolves asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT...

Linux Distros Unpatched Vulnerability : CVE-2025-31498

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in readanswers when processanswer may re-enqueue a query eithe...

Azure Linux 3.0 Security Update: c-ares / fluent-bit / grpc / nodejs (CVE-2023-31130)

The version of c-ares / fluent-bit / grpc / nodejs installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-31130 advisory. - c-ares is an asynchronous resolver library. aresinetnetpton is vulnerable to a...

OPENSUSE-SU-2025:14977-1 c-ares-devel-1.34.5-1.1 on GA media

These are all security issues fixed in the c-ares-devel-1.34.5-1.1 package on the GA media of openSUSE Tumbleweed...