CVE-2023-31147: Insufficient randomness in generation of DNS query IDs in c-ares

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-25 · updated 2026-06-17
Weakness: CWE-330

Description

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.

Affected products

C-Ares Project C-Ares: before 1.19.1 — fixed in 1.19.1
Fedoraproject Fedora: 37, 38

How to fix

Upgrade to a fixed version: C-Ares Project C-Ares 1.19.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-31147 or the next vulnerability affects your stack