c
c-ares
Security Risk Profile
41
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 18 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from October 3, 2016 to present
18
Total CVEs
6
Critical+High
0
Exploited
2
Unpatched
Threat Assessment
Avg CVSS
6.1
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
2
Critical/High
Risk Level
41/100
medium
Severity Distribution
Critical
2High
4Medium
8Low
2Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
2Age Distribution
Common Weaknesses (CWE)
1
Use After Free
5
2
Double Free
2
3
Buffer Overflow
2
4
Infoleak
1
Most Affected Products
1. c-ares c-ares42
2. ubuntu/c-ares14
3. Fedoraproject Fedora10
4. Nodejs Node.js10
5. C-ares Project C-ares6
Recent Vulnerabilities
See more →CVE-2026-33630
CVSS 7.5high
c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP
Jul 6, 2026🔧 No Patch
CVE-2025-62408
CVSS 5.9medium
c-ares has a Use After Free vulnerability when connection is cleaned up after error
Dec 8, 2025
REDHAT-BUG-2358271
CVSS 4.0medium
Apr 8, 2025🔧 No Patch
CVE-2025-31498
CVSS 8.3EPSS 0%high
c-ares has a use-after-free in read_answers()
Apr 8, 2025
https://seclists.org/oss-sec/2025/q2/27
unknown
CVE-2025-31498: c-as use-after-fe
Apr 8, 2025🔧 No Patch
https://seclists.org/oss-sec/2024/q1/157
unknown
c-ares CVE-2024-25629
Feb 23, 2024🔧 No Patch
CVE-2024-25629
CVSS 5.5EPSS 0%medium
c-ares out of bounds read in ares__read_line()
Feb 23, 2024
CVE-2020-22217
CVSS 9.8critical
Aug 22, 2023
REDHAT-BUG-2209502
CVSS 7.0high
May 24, 2023🔧 No Patch
CVE-2023-31147
CVSS 6.5medium
Insufficient randomness in generation of DNS query IDs in c-ares
May 24, 2023
Monitor c-ares in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.