This is all known and public c-ares vulnerabilities to date. See also our security incident process.

High. Use-after-free / double-free in c-ares' query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP. Fixed in 1.34.7. CVE-2026-33630

High. CPU-exhaustion denial of service via unbounded DNS name compression pointer chains. Fixed in 1.34.7. GHSA-pjmc-gx33-gc76

Moderate. Memory-amplification denial of service via unvalidated DNS header record counts. Fixed in 1.34.7. GHSA-jv8r-gqr9-68wj

Moderate. A use-after-free bug has been uncovered in read_answers() that was introduced in v1.32.3. CVE-2025-62408

High. A use-after-free bug has been uncovered in read_answers() that was introduced in v1.32.3. CVE-2025-31498

Moderate. Reading malformatted /etc/resolv.conf, /etc/nsswitch.conf or the HOSTALIASES file could result in a crash. Fixed in 1.27.0. CVE-2024-25629

High. 0-byte UDP payload causes Denial of Service. Fixed in 1.19.1. CVE-2023-32067

Moderate. Insufficient randomness in generation of DNS query IDs. Fixed in 1.19.1. CVE-2023-31147

Moderate. Buffer Underwrite in ares_inet_net_pton(). Fixed in 1.19.1. CVE-2023-31130

Low. AutoTools does not set CARES_RANDOM_FILE during cross compilation. Fixed in 1.19.1. CVE-2023-31124

The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity. Fixed in 1.19.0. CVE-2022-4904

Missing input validation on hostnames returned by DNS servers

NAPTR parser out of bounds access

ares_create_query single byte out of buffer write

The ares_init:randomize_key function uses the rand command to produce random numbers. A remote attacker could exploit this vulnerability to possibly spoof hostnames and addresses in the DNS cache. project advisory.

For unknown reasons, it seems CVE-2007-3152 is also often used to refer to this same issue.

This flaw was fixed in 1.4.0.