What’s Vulnerable › Products

c-ares vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your c-ares version is affected

Latest c-ares vulnerabilities

• CVE-2026-69186 — c-ares: Memory-amplification denial of service via unvalidated DNS header record counts (CVSS 5.3)
• CVE-2026-69184 — c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (CVSS 7.5)
• CVE-2026-33630 — c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP (CVSS 7.5)
• CVE-2025-62408 — c-ares has a Use After Free vulnerability when connection is cleaned up after error (CVSS 5.9)
• CVE-2025-31498 — c-ares has a use-after-free in read_answers() (CVSS 8.3)
• CVE-2024-25629 — c-ares out of bounds read in ares__read_line() (CVSS 5.5)
• CVE-2020-22217 — (CVSS 5.9)
• CVE-2020-14354 — (CVSS 3.3)
• CVE-2017-1000381 — (CVSS 7.5)
• CVE-2016-5180 — (CVSS 9.8)