Critical Use-After-Free Vulnerability in c-ares Package
Summary
ALPINE-CVE-2025-31498: c-ares is an asynchronous resolver library. Affects c-ares versions < 1.34.5-r0. Fixed in 1.34.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
c-ares is an asynchronous resolver library that provides a way to perform DNS requests without blocking the calling thread. It is widely used in applications that require non-blocking DNS resolution. The library is designed for efficiency and is particularly useful in environments where performance is critical. However, certain versions of c-ares are vulnerable to a use-after-free issue that can lead to potential security risks.
Vulnerability Detail
The vulnerability arises from a use-after-free condition in the read_answers() function of c-ares, affecting versions from 1.32.3 to 1.34.4. This issue occurs when process_answer() may re-enqueue a query due to a DNS Cookie Failure or improper EDNS support from the upstream server. If a connection handle is closed while read_answers() still expects it to be available, it can lead to undefined behavior. A remote attacker could exploit this by flooding the target with ICMP UNREACHABLE packets, provided they control the upstream nameserver. Alternatively, a local attacker could manipulate system behavior to trigger failure conditions in send()/write(). This vulnerability is fixed in version 1.34.5.
How To Fix
Minimum fixed version
1.34.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade c-aresTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the exposure of your application to untrusted DNS servers or implementing additional network security measures to mitigate the risk of exploitation.
Conclusion
The c-ares library has a critical vulnerability that can be exploited under certain conditions. It is essential to update to version 1.34.5 or later to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for c-ares →
FAQ
c-ares is an asynchronous DNS resolver library that allows applications to perform DNS queries without blocking the main thread, enhancing performance in networked applications.
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to crashes or arbitrary code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities in real-time.
Yes, if an attacker can control the upstream nameserver and flood the target with specific packets, they may exploit this vulnerability remotely.
If immediate updates are not possible, consider implementing network security measures to limit exposure to untrusted DNS servers as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for c-ares.
