CVE-2025-62408
Medium · 5.9CVSS
5.9
EPSS
0.4%
Published
Dec 8, 2025
CISA due date
—
The record
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | c-ares | 0 | 1.34.6-1.1 |
| openSUSE:Tumbleweed | istioctl | 0 | 1.28.2-1.1 |
Related vulnerabilities
- CVE-2017-1000381 The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR… Also affects c-ares
- CVE-2016-5180 Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0… Also affects c-ares
- CVE-2026-47220 Envoy is an open source edge and service proxy designed for cloud-native applications. Also affects istioctl
- CVE-2026-48090 Envoy is an open source edge and service proxy designed for cloud-native applications. Also affects istioctl
- CVE-2026-47205 Envoy is an open source edge and service proxy designed for cloud-native applications. Also affects istioctl
- CVE-2026-48743 Envoy is an open source edge and service proxy designed for cloud-native applications. Also affects istioctl
- CVE-2026-48706 Envoy is an open source edge and service proxy designed for cloud-native applications. Also affects istioctl
- CVE-2026-48044 Envoy is an open source edge and service proxy designed for cloud-native applications. Also affects istioctl