c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.

FA plugin updates for vendor_unpatched: 2025/04/09 01:22 chunk 1/1

The version of c-ares installed on the remote host is affected by a use after free vulnerability. c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-942a0d7e5d advisory.

    Update to 1.34.5. Fixes CVE-2025-31498.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-c26ac54608 advisory.

    Update to 1.34.5. Fixes CVE-2025-31498.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in     read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the     upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the     connection immediately after a response. If there was an issue trying to put that new transaction on the     wire, it would close the connection handle, but read_answers() was still expecting the connection handle     to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger     this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and     can return a result with one of those conditions, this has been untested. Otherwise only a local attacker     might be able to change system behavior to make send()/write() return a failure condition. This     vulnerability is fixed in 1.34.5. (CVE-2025-31498)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
234803	c-ares 1.32.3 < 1.34.5 Use After Free (macOS)	Nessus	MacOS X Local Security Checks	high
234785	Fedora 40 : c-ares (2025-942a0d7e5d)	Nessus	Fedora Local Security Checks	high
234696	Fedora 41 : c-ares (2025-c26ac54608)	Nessus	Fedora Local Security Checks	high
234193	Linux Distros Unpatched Vulnerability : CVE-2025-31498	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-31498

high

Tenable Plugins

Coming Soon

high

high

high

critical