CVE-2025-31498 c-ares has a use-after-free in read_answers()
A use-after-free in c-ares allows remote or local attackers to cause denial of service or potentially execute code via crafted DNS responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-31498?
CVE-2025-31498 is a high-severity use after free vulnerability in c-ares, published on 8 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.
Weakness: CWE-416
Which versions are affected by CVE-2025-31498?
Linux distribution packages (40)
nodejs AlmaLinux:10 | All versions | 1:22.15.0-1.el10_0 |
nodejs-devel AlmaLinux:10 | All versions | 1:22.15.0-1.el10_0 |
nodejs-docs AlmaLinux:10 | All versions | 1:22.15.0-1.el10_0 |
nodejs-full-i18n AlmaLinux:10 | All versions | 1:22.15.0-1.el10_0 |
nodejs-libs AlmaLinux:10 | All versions | 1:22.15.0-1.el10_0 |
nodejs-npm AlmaLinux:10 | All versions | 1:10.9.2-1.22.15.0.1.el10_0 |
nodejs AlmaLinux:8 | All versions | 1:20.19.1-1.module_el8.10.0+3987+dbda4426 |
nodejs-devel AlmaLinux:8 | All versions | 1:20.19.1-1.module_el8.10.0+3987+dbda4426 |
nodejs-docs AlmaLinux:8 | All versions | 1:20.19.1-1.module_el8.10.0+3987+dbda4426 |
nodejs-full-i18n AlmaLinux:8 | All versions | 1:20.19.1-1.module_el8.10.0+3987+dbda4426 |
nodejs-nodemon AlmaLinux:8 | All versions | 3.0.1-1.module_el8.10.0+3982+85c136aa |
nodejs-packaging AlmaLinux:8 | All versions | 2021.06-4.module_el8.10.0+3987+dbda4426 |
nodejs-packaging-bundler AlmaLinux:8 | All versions | 2021.06-4.module_el8.10.0+3958+472a6467 |
npm AlmaLinux:8 | All versions | 1:10.8.2-1.20.19.1.1.module_el8.10.0+3987+dbda4426 |
nodejs AlmaLinux:9 | All versions | 1:20.19.1-1.module_el9.6.0+163+d268fe53 |
nodejs-devel AlmaLinux:9 | All versions | 1:20.19.1-1.module_el9.6.0+163+d268fe53 |
nodejs-docs AlmaLinux:9 | All versions | 1:20.19.1-1.module_el9.6.0+163+d268fe53 |
nodejs-full-i18n AlmaLinux:9 | All versions | 1:20.19.1-1.module_el9.6.0+163+d268fe53 |
nodejs-nodemon AlmaLinux:9 | All versions | 3.0.1-1.module_el9.5.0+125+8dc38870 |
nodejs-packaging AlmaLinux:9 | All versions | 2021.06-4.module_el9.6.0+162+8dc602e5 |
nodejs-packaging-bundler AlmaLinux:9 | All versions | 2021.06-4.module_el9.6.0+162+8dc602e5 |
npm AlmaLinux:9 | All versions | 1:10.8.2-1.20.19.1.1.module_el9.6.0+163+d268fe53 |
nodejs Red Hat:enterprise_linux:10.0 | All versions | 1:22.15.0-1.el10_0 |
nodejs-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 1:22.15.0-1.el10_0 |
nodejs-devel Red Hat:enterprise_linux:10.0 | All versions | 1:22.15.0-1.el10_0 |
nodejs-docs Red Hat:enterprise_linux:10.0 | All versions | 1:22.15.0-1.el10_0 |
nodejs-full-i18n Red Hat:enterprise_linux:10.0 | All versions | 1:22.15.0-1.el10_0 |
nodejs-libs Red Hat:enterprise_linux:10.0 | All versions | 1:22.15.0-1.el10_0 |
nodejs-libs-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 1:22.15.0-1.el10_0 |
nodejs-npm Red Hat:enterprise_linux:10.0 | All versions | 1:10.9.2-1.22.15.0.1.el10_0 |
nodejs22 Red Hat:enterprise_linux:10.0 | All versions | 1:22.15.0-1.el10_0 |
nodejs22-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 1:22.15.0-1.el10_0 |
nodejs22-debugsource Red Hat:enterprise_linux:10.0 | All versions | 1:22.15.0-1.el10_0 |
nodejs Red Hat:enterprise_linux:8::appstream | All versions | 1:20.19.1-1.module+el8.10.0+23054+5431297f |
nodejs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:20.19.1-1.module+el8.10.0+23054+5431297f |
nodejs-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:20.19.1-1.module+el8.10.0+23054+5431297f |
nodejs-devel Red Hat:enterprise_linux:8::appstream | All versions | 1:20.19.1-1.module+el8.10.0+23054+5431297f |
nodejs-docs Red Hat:enterprise_linux:8::appstream | All versions | 1:20.19.1-1.module+el8.10.0+23054+5431297f |
nodejs-full-i18n Red Hat:enterprise_linux:8::appstream | All versions | 1:20.19.1-1.module+el8.10.0+23054+5431297f |
nodejs-nodemon Red Hat:enterprise_linux:8::appstream | All versions | 0:3.0.1-1.module+el8.10.0+22904+d0fedeff |
How do I fix CVE-2025-31498?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-31498 being exploited?
There is no known exploitation of CVE-2025-31498 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-31498, ALSA-2025:4461, ALSA-2025:7426, ALSA-2025:7502, AZL-59742, BELL-CVE-2025-31498 and 14 more.