CVE-2017-1000381
HighSummary
The `ares_parse_naptr_reply()` function in the c-ares library may read memory outside of the given input buffer if the passed DNS response packet is crafted in a specific way.
Risk Assessment
This could lead to the exposure of sensitive data in memory, posing a security risk to applications using this library.
Recommendation
It is recommended to update the c-ares library to the latest version to mitigate the risk associated with this vulnerability.
Other vulnerabilities in c-ares
See all- CVE-2026-33630High
A use-after-free and double-free vulnerability was found in the c-ares library in the query-completion handling path. The flaw occurs when a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via ares_getaddrinfo() over TCP by sending crafted data.
- CVE-2016-5180Critical
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a hostname with an escaped trailing dot.
Original NVD description (English source)
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.