CVE-2025-62408 Details
Description
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
A denial-of-service vulnerability has been identified in c-ares, an asynchronous resolver library, affecting versions 1.32.3 through 1.34.5. The issue arises in the read_answer() and process_answer() functions, where a query can be terminated after the maximum number of attempts. This premature termination can lead to a use-after-free condition, causing the connection to be closed while potentially allowing additional answers to be processed, which can disrupt normal operation and cause a crash.
Users can upgrade to c-ares version 1.34.6 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 9, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| c-ares c-ares | >= 1.32.3, < 1.34.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 2, 2026 | Initial Analysis | [email protected] |
| Dec 8, 2025 | New CVE Received | [email protected] |