Skip to content
Fencer Vulns
high 8.3

CVE-2025-31498 json

c-ares has a use-after-free in read_answers()

published 2025-04-08 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-10377

cvss
8.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.

Patch / fix

  • c-ares c-ares 1.34.5
  • c-ares_project c-ares 1.34.5
  • c-ares Debian 14, Debian 13 1.34.5-1

debian advisories DEBIAN-CVE-2025-31498

  • nodejs-nodemon RHEL 9, RHEL 9.4 EUS 3.0.1-1.module+el9.3.0.z+20478+84a9f781
  • nodejs-packaging RHEL 9, RHEL 9.4 EUS 2021.06-4.module+el9.3.0+19518+63aad52d
  • nodejs-packaging-bundler RHEL 9, RHEL 9.4 EUS 2021.06-4.module+el9.3.0+19518+63aad52d
  • nodejs22 RHEL 10.0 1:22.15.0-1.el10_0
  • nodejs RHEL 10.0 1:22.15.0-1.el10_0
  • nodejs-npm RHEL 10.0 1:10.9.2-1.22.15.0.1.el10_0
  • nodejs-libs RHEL 10.0 1:22.15.0-1.el10_0
  • nodejs-full-i18n RHEL 10.0 1:22.15.0-1.el10_0

red hat advisories RHSA-2025:7537RHSA-2025:7502RHSA-2025:7433RHSA-2025:7426RHSA-2025:4461RHSA-2025:4459

  • c-ares SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 1.34.8-150000.3.29.1
  • c-ares Linux Micro 6.1 1.34.8-slfo.1.1_1.1
  • c-ares Linux Micro 6.0 1.34.8-1.1

suse advisories SUSE-SU-2026:4021-1SUSE-SU-2026:23414-1SUSE-SU-2026:23364-1

  • c-ares openSUSE Tumbleweed 1.34.5-1.1

opensuse advisories openSUSE-SU-2025:14977-1

  • npm AlmaLinux 9 1:10.8.2-1.20.19.1.1.module_el9.6.0+163+d268fe53
  • nodejs AlmaLinux 9 1:20.19.1-1.module_el9.6.0+163+d268fe53
  • nodejs-nodemon AlmaLinux 9 3.0.1-1.module_el9.5.0+125+8dc38870
  • nodejs-full-i18n AlmaLinux 9 1:20.19.1-1.module_el9.6.0+163+d268fe53
  • nodejs-packaging AlmaLinux 9 2021.06-4.module_el9.6.0+162+8dc602e5
  • nodejs-packaging-bundler AlmaLinux 9 2021.06-4.module_el9.6.0+162+8dc602e5
  • npm AlmaLinux 9 1:10.9.2-1.22.15.0.1.module_el9.6.0+164+2d89b8ed
  • nodejs AlmaLinux 9 1:22.15.0-1.module_el9.6.0+164+2d89b8ed

almalinux advisories ALSA-2025:7426ALSA-2025:7433ALSA-2025:7502ALSA-2025:4459ALSA-2025:4461

  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.5.0+31770+0da7192d
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.5.0+31785+5534beb0
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.5.0+31770+0da7192d
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.5.0+31786+d18c719d
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.5.0+31785+5534beb0
  • nodejs Rocky Linux 8 1:22.15.0-1.module+el8.10.0+1971+0bb08ece
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1988+437f3d23
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1989+e60144d9

rocky linux advisories RLSA-2025:7426RLSA-2025:7433RLSA-2025:4459RLSA-2025:4461

  • c-ares Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 1.34.5-r0

alpine advisories ALPINE-CVE-2025-31498

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • fluent-bit Azure Linux 3.0 3.1.9-4

azure linux advisories AZL-59742

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-31498 updated cvss 7.0

c-ares: c-ares has a use-after-free in read_answers()

  • Red Hat Enterprise Linux 6 c-ares Red Hat Enterprise Linux 7 c-ares
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 20.19.1-1.module+el8.10.0+23054+5431297f, nodejs 22.15.0-1.module+el8.10.0+23068+28ff2340, nodejs-libs 22.15.0-1.module+el8.10.0+23068+28ff2340, nodejs-nodemon 3.0.1-1.module+el8.10.0+22904+d0fedeff, nodejs-nodemon 3.0.1-1.module+el8.10.0+23068+28ff2340, npm 10.8.2-1.20.19.1.1.module+el8.10.0+23054+5431297f, +7 more
    fixed: vendor fix RHSA-2025:4461
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 20.19.1-1.module+el9.6.0+23053+4195b0b2, nodejs 22.15.0-1.module+el9.6.0+23062+9e7801b9, nodejs-libs 22.15.0-1.module+el9.6.0+23062+9e7801b9, nodejs-nodemon 3.0.1-1.module+el9.6.0+23062+9e7801b9, npm 10.8.2-1.20.19.1.1.module+el9.6.0+23053+4195b0b2, npm 10.9.2-1.22.15.0.1.module+el9.6.0+23062+9e7801b9, +7 more
    fixed: vendor fix RHSA-2025:7426
  • Red Hat Enterprise Linux AppStream (v. 10) nodejs 22.15.0-1.el10_0, nodejs22 22.15.0-1.el10_0, nodejs-libs 22.15.0-1.el10_0, nodejs-full-i18n 22.15.0-1.el10_0, nodejs-npm 10.9.2-1.22.15.0.1.el10_0
    fixed: vendor fix RHSA-2025:7502
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) nodejs 20.18.2-2.module+el9.4.0+23089+aaa18a20, npm 10.8.2-1.20.18.2.2.module+el9.4.0+23089+aaa18a20, nodejs-nodemon 3.0.1-1.module+el9.3.0.z+20478+84a9f781, nodejs-full-i18n 20.18.2-2.module+el9.4.0+23089+aaa18a20, nodejs-packaging 2021.06-4.module+el9.3.0+19518+63aad52d, nodejs-packaging-bundler 2021.06-4.module+el9.3.0+19518+63aad52d
    fixed: vendor fix RHSA-2025:7537
  • Red Hat Enterprise Linux 8 npm, c-ares, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, +2 more Red Hat Enterprise Linux 9 npm, c-ares, nodejs, nodejs-libs, nodejs-full-i18n Red Hat Enterprise Linux 10 c-ares Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • c-ares c-ares

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.