CVE-2025-62408 — c-ares has a Use After Free vulnerability when connection is cleaned up after error
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cau…
Published: 2025-12-08 · CVSS: 5.9 · CVSS 3.1
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7