CVE-2025-31498

Name	CVE-2025-31498
Description	c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
c-ares (PTS)	bullseye (security), bullseye	1.17.1-1+deb11u3	fixed
	bookworm	1.18.1-3	fixed
	sid, trixie	1.34.5-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
c-ares	source	bullseye	(not affected)
c-ares	source	bookworm	(not affected)
c-ares	source	(unstable)	1.34.5-1

Notes

[bookworm] - c-ares <not-affected> (Vulnerable code not present)
[bullseye] - c-ares <not-affected> (Vulnerable code not present)
https://github.com/c-ares/c-ares/security/advisories/GHSA-6hxc-62jh-p29v
Introduced after: https://github.com/c-ares/c-ares/commit/ccd11aa37771ece1956c791a6232995317ac595e (v1.32.3)