Use-After-Free Vulnerability in c-ares Library (CVE-2025-31498)
Summary
CVE-2025-31498: c-ares is an asynchronous resolver library. Affects c-ares across 2 version ranges.
< 1.34.5-r0
< 29d38719112639d8c0ba910254a3dd4f482ea2d1
Fixed in 1.34.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
c-ares is an asynchronous resolver library designed for DNS queries. It allows applications to perform DNS lookups without blocking the main thread, making it suitable for high-performance applications. The library is widely used in various software projects due to its efficiency and non-blocking nature. However, certain versions of c-ares, specifically from 1.32.3 to 1.34.4, are vulnerable to a use-after-free issue that can lead to unexpected behavior or security risks.
Vulnerability Detail
The vulnerability arises in the read_answers() function, where a use-after-free condition occurs if process_answer() re-enqueues a query due to DNS Cookie Failure or improper EDNS support from the upstream server. This can happen if the remote server closes the connection immediately after sending a response. An attacker could exploit this by flooding the target with ICMP UNREACHABLE packets, provided they control the upstream nameserver. This vulnerability poses a risk of denial of service or unintended behavior in applications using the affected versions of c-ares.
How To Fix
Minimum fixed version
1.34.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade c-aresTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to update to the patched version as soon as possible to mitigate any potential risks.
Conclusion
The CVE-2025-31498 vulnerability in the c-ares library poses significant risks due to a use-after-free condition. Users of affected versions should promptly update to version 1.34.5 or later to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for c-ares →
FAQ
CVE-2025-31498 is a vulnerability in the c-ares library that allows for a use-after-free condition, potentially leading to security risks.
Versions 1.32.3 through 1.34.4 of c-ares are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability could lead to denial of service or unintended behavior in applications that rely on the c-ares library.
Yes, the vulnerability is fixed in c-ares version 1.34.5. It is recommended to update to this version or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for c-ares.
