c-ares
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 3
en
Verify to analyze this security profile
As of 09/19/2026, c-ares recorded 3 security vulnerabilities in the last 90 days across 1 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, c-ares had the most security vulnerabilities in the c-ares ecosystem, with 3 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-69184c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains | Exploitation statusNot confirmed | FixYes | Affected productc-ares | Published09/18/2026 | SeverityHigh |
CVE-2026-69186c-ares: Memory-amplification denial of service via unvalidated DNS header record counts | Exploitation statusPublic exploit | FixYes | Affected productc-ares | Published09/18/2026 | SeverityMedium |
CVE-2026-33630c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP | Exploitation statusNot known exploited | FixYes | Affected productc-ares | Published09/03/2026 | SeverityHigh |
CVE-2025-62408c-ares has a Use After Free vulnerability when connection is cleaned up after error | Exploitation statusNot known exploited | FixYes | Affected productc-ares | Published12/08/2025 | SeverityMedium |
CVE-2025-31498c-ares has a use-after-free in read_answers() | Exploitation statusNot known exploited | FixYes | Affected productc-ares | Published04/08/2025 | SeverityHigh |
CVE-2024-25629c-ares out of bounds read in ares__read_line() | Exploitation statusNot known exploited | FixYes | Affected productc-ares | Published02/23/2024 | SeverityMedium |
CVE-2020-22217 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/22/2023 | SeverityUnknown |
CVE-2023-320670-byte UDP payload DoS in c-ares | Exploitation statusNot known exploited | FixYes | Affected productc-ares | Published05/25/2023 | SeverityHigh |
CVE-2023-31147Insufficient randomness in generation of DNS query IDs in c-ares | Exploitation statusNot known exploited | FixYes | Affected productc-ares | Published05/25/2023 | SeverityMedium |
CVE-2023-31130Buffer Underwrite in ares_inet_net_pton() | Exploitation statusNot known exploited | FixYes | Affected productc-ares | Published05/25/2023 | SeverityMedium |
CVE-2023-31124AutoTools does not set CARES_RANDOM_FILE during cross compilation | Exploitation statusNot known exploited | FixYes | Affected productc-ares | Published05/25/2023 | SeverityLow |
CVE-2020-14354 | Exploitation statusNot confirmed | FixNot confirmed | Affected productc-ares | Published05/13/2021 | SeverityUnknown |
CVE-2017-1000381 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/07/2017 | SeverityUnknown |
CVE-2016-5180 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/03/2016 | SeverityUnknown |