OPENSUSE-SU-2026:11593-1 c-ares-devel-1.34.8-1.1 on GA media

These are all security issues fixed in the c-ares-devel-1.34.8-1.1 package on the GA media of openSUSE Tumbleweed...

Astra Linux – Vulnerability in c-ares

A flaw was discovered in the c-ares library. A missing input validation check for host names returned by DNS Domain Name Servers can result in incorrect hostnames being displayed. This could potentially lead to Domain Hijacking. The greatest threat posed by this vulnerability is related to...

Astra Linux – Vulnerability in c-ares

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service attacks. When a target resolver sends a query, the attacker creates a malformed UDP packet with a length of 0 and sends it back to the target resolver. The target resolver misinterprets this 0-length field as an...

Astra Linux – Vulnerability in c-ares

A flaw was discovered in the c-ares package. The aressetsortlist function lacks checks for the validity of the input string, which could lead to a stack overflow vulnerability with an arbitrary length. This issue may cause a denial of service or have a limited impact on confidentiality and...

PT-2026-80176

Name of the Vulnerable Software and Affected Versions c-ares versions prior to 1.34.8-1.1 Description A memory-amplification denial of service occurs due to unvalidated DNS header record counts. This allows an attacker to cause excessive memory consumption by manipulating the record counts in DNS...

PT-2026-80175

Name of the Vulnerable Software and Affected Versions c-ares versions prior to 1.34.8-1.1 Description A CPU-exhaustion denial of service occurs due to unbounded DNS name compression pointer chains. This issue allows an attacker to cause excessive CPU usage by providing specially crafted DNS...

Linux Distros Unpatched Vulnerability : CVE-2026-69184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - c-ares - None Ubuntu Linux - GHSA-pjmc-gx33-gc76: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains CVE-2026-691...

Linux Distros Unpatched Vulnerability : CVE-2026-69186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - c-ares - None Ubuntu Linux - GHSA-jv8r-gqr9-68wj: Memory-amplification denial of service via unvalidated DNS header record counts CVE-2026-69186...

Oracle Linux 9 : nodejs:22 (ELSA-2026-47058)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47058 advisory. - Fix CVE-2026-59873, CVE-2026-59874 node-tar by rebasing npm's bundled tar to 7.5.19 - Fix CVE-2026-13149 brace-expansion in npm's bundled...

TencentOS Server 4: nodejs20 (TSSA-2026:0665)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0665 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

RHSA-2026:42096 Red Hat Security Advisory: c-ares security update

Bulletin has no description...

Oracle Linux 10 : c-ares (ELSA-2026-42096)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-42096 advisory. 1.34.6-2 - Fix double-free in processtimeouts CVE-2026-33630 Resolves: RHEL-192867 Tenable has extracted the preceding description block directly from the...

RLSA-2026:42096 Important: c-ares security update

The c-ares C library defines asynchronous DNS Domain Name System requests and provides name resolving API. Security Fixes: c-ares: c-ares: Use-after-free / double-free in query-completion handling CVE-2026-33630 For more details about the security issues, including the impact, a CVSS score,...

c-ares security update

An update is available for c-ares. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The c-ares C library defines asynchronous DNS Domain Name System requests and...

RockyLinux 10 : c-ares (RLSA-2026:42096)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:42096 advisory. c-ares: c-ares: Use-after-free / double-free in query-completion handling CVE-2026-33630 Tenable has extracted the preceding description block directly from the...

[SECURITY] Fedora 43 Update: c-ares-1.34.8-1.fc43

c-ares is a C library that performs DNS requests and name resolves asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT...

AlmaLinux 10 : c-ares (ALSA-2026:42096)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:42096 advisory. c-ares: c-ares: Use-after-free / double-free in query-completion handling CVE-2026-33630 Tenable has extracted the preceding description block directly from the...

Important: Red Hat Security Advisory: c-ares security update

An update for c-ares is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

c-ares: c-ares: Use-after-free / double-free in query-completion handling

A flaw was found in c-ares. A use-after-free / double-free vulnerability exists in the query-completion handling path, where a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via aresgetaddrinfo over TCP by sending crafte...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1981)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1981 advisory. A use-after-free / double-free in c-ares' query-completion handling. Thesame flaw -- a query's callback being invoked while the query is stilllinked in the channel's internal lookup structures -- is...