Medium severity5.9NVD Advisory· Published Dec 8, 2025· Updated Jun 17, 2026

CVE-2025-62408

Description

c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

C Ares/C Ares3 versions
cpe:2.3:a:c-ares:c-ares:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:c-ares:c-ares:*:*:*:*:*:*:*:*range: >=1.32.3,<1.34.6
- (no CPE)range: 1.32.3 - 1.34.5
- (no CPE)range: > 1.32.3, < 1.34.6
osv-coords2 versions
pkg:rpm/opensuse/istioctl&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/c-ares&distro=openSUSE%20Tumbleweed
< 1.28.2-1.1+ 1 more
- (no CPE)range: < 1.28.2-1.1
- (no CPE)range: < 1.34.6-1.1

Patches

Vulnerability mechanics

References

github.com/c-ares/c-ares/commit/714bf5675c541bd1e668a8db8e67ce012651e618nvdPatch
github.com/c-ares/c-ares/security/advisories/GHSA-jq53-42q6-pqr5nvdPatchVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000