PT-2025-15436 · C-Ares+5 · C-Ares+5
Published
2025-04-08
·
Updated
2025-11-18
·
CVE-2025-31498
CVSS v4.0
8.3
High
| Vector | AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
c-ares versions 1.32.3 through 1.34.4
Node.js versions prior to 22.15.0
Description
A use-after-free vulnerability exists in the
read answers() function of c-ares, a library used for asynchronous DNS resolution. This occurs when process answer() may re-enqueue a query due to a DNS Cookie Failure or if the upstream server does not properly support EDNS, or potentially on TCP queries if the remote connection is closed immediately after a response. If an issue occurs while attempting to place the new transaction on the wire, the connection handle is closed, but read answers() still expects it to be available. A remote attacker could potentially exploit this by flooding the target with ICMP UNREACHABLE packets if they control the upstream nameserver, or a local attacker could manipulate system behavior to cause send() or write() to return a failure condition. This vulnerability is addressed in c-ares version 1.34.5.Recommendations
Update c-ares to version 1.34.5 or later.
Update Node.js to version 22.15.0 or later.
Exploit
Fix
RCE
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Red Hat
Rocky Linux
Ubuntu
C-Ares