CVE-2025-62408 Overview
CVE-2025-62408 affects the c-ares asynchronous DNS resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), leading to a denial of service condition. The underlying weakness is classified as a use-after-free [CWE-416]. The maintainers addressed the issue in version 1.34.6.
c-ares is widely embedded in language runtimes, container tooling, and network utilities that require non-blocking DNS resolution. Applications that reuse or reference the DNS record structure after query termination are exposed to memory safety issues that can crash the host process.
Critical Impact
A remote attacker able to influence DNS responses can trigger repeated query retries that cause the resolver to reach maximum attempts and terminate, resulting in a use-after-free that crashes affected applications.
Affected Products
- c-ares versions 1.32.3 through 1.34.5
- Applications and runtimes statically or dynamically linking vulnerable c-ares builds
- Downstream distributions packaging c-ares in the affected version range
Discovery Timeline
- 2025-12-08 - CVE-2025-62408 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-62408
Vulnerability Analysis
The defect resides in c-ares query lifecycle handling. When read_answer() and process_answer() process a DNS response, the resolver may reach the maximum retry count and terminate the query. Terminating the query releases resources referenced by the DNS record structure while subsequent code paths still hold pointers to that memory. Access after release produces a use-after-free, satisfying the [CWE-416] pattern.
The consumer-facing impact is a denial of service. The attack requires network position or the ability to influence DNS responses reaching the resolver, and the exploit path depends on race timing between answer processing and query teardown.
Root Cause
The root cause is ownership ambiguity of the ares_dns_record_t structure across the query retry and cache insertion paths. The pre-patch signatures accepted const ares_dns_record_t * in ares_qcache_insert() while the internal cache stored the pointer directly, allowing subsequent teardown of the query to free memory still referenced by the cache.
Attack Vector
Exploitation requires an attacker to influence DNS responses so the resolver exhausts its retry budget. The attack vector is network-based with high complexity, no privileges required, and no user interaction. Successful triggering crashes the calling application, producing service unavailability for any workload that depends on c-ares for name resolution.
// Patch excerpt: src/lib/ares_private.h and src/lib/ares_qcache.c
ares_status_t ares_requeue_query(ares_query_t *query, const ares_timeval_t *now,
ares_status_t status,
ares_bool_t inc_try_count,
- const ares_dns_record_t *dnsrec,
+ ares_dns_record_t *dnsrec,
ares_array_t **requeue);
-ares_status_t ares_qcache_insert(ares_channel_t *channel,
- const ares_timeval_t *now,
- const ares_query_t *query,
- ares_dns_record_t *dnsrec)
+ares_status_t ares_qcache_insert(ares_channel_t *channel,
+ const ares_timeval_t *now,
+ const ares_query_t *query,
+ const ares_dns_record_t *dnsrec)
{
- return ares_qcache_insert_int(channel->qcache, dnsrec, query->query, now);
+ ares_dns_record_t *dupdns = ares_dns_record_duplicate(dnsrec);
+ ares_status_t status;
+
+ if (dupdns == NULL) {
+ return ARES_ENOMEM;
+ }
+ status = ares_qcache_insert_int(channel->qcache, dupdns, query->query, now);
+ if (status != ARES_SUCCESS) {
+ ares_dns_record_destroy(dupdns);
+ }
+ return status;
}
Source: c-ares commit 714bf5675c541bd1e668a8db8e67ce012651e618. The fix duplicates the DNS record before cache insertion so cache ownership is independent of the query lifecycle.
Detection Methods for CVE-2025-62408
Indicators of Compromise
- Repeated crashes of processes linked against c-ares immediately following DNS activity
- Core dumps referencing ares_qcache_insert, ares_requeue_query, read_answer, or process_answer frames
- Unusual spikes in DNS retry counts or timeouts in application logs
Detection Strategies
- Inventory installed c-ares versions with ldd, package managers, and software composition analysis tools to flag versions in the 1.32.3 through 1.34.5 range
- Correlate application crash telemetry with concurrent DNS anomalies to identify triggered exploitation attempts
- Enable core dump collection on production hosts running c-ares consumers such as Node.js, cURL, and gRPC
Monitoring Recommendations
- Alert on abnormal DNS retry patterns or a rise in truncated responses reaching resolver endpoints
- Monitor process restart counts for services that embed c-ares to catch repeated crashes
- Track network paths for on-path attackers capable of injecting or delaying DNS responses to internal resolvers
How to Mitigate CVE-2025-62408
Immediate Actions Required
- Upgrade c-ares to version 1.34.6 or later across all systems and container images
- Rebuild and redeploy applications that statically link c-ares once the updated library is available
- Prioritize remediation on internet-facing services and shared resolver infrastructure
Patch Information
The fix is delivered in c-ares 1.34.6. Review the GitHub Security Advisory GHSA-jq53-42q6-pqr5 and the upstream commit 714bf56 for change details. Redistributors should pull the patched release into downstream packages and container base images.
Workarounds
- Restrict DNS resolution to trusted internal resolvers to reduce attacker influence over query responses
- Enforce DNSSEC validation and DNS over TLS where feasible to limit response tampering
- Add process supervision to restart affected services quickly if a crash occurs
# Verify installed c-ares version and upgrade
ares_config --version
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade libc-ares2
# RHEL/Alma/Rocky
sudo dnf upgrade c-ares
# From source
git clone https://github.com/c-ares/c-ares.git
cd c-ares && git checkout v1.34.6
./buildconf && ./configure && make && sudo make install
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
