[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiGhplVt7xq9BZ8dZMExqBBIwuxhp6wO7wh-xmUpY2WM":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":19,"kevVulnerabilities":55,"topProductsByCves":56,"seoMetadata":58,"meta":67},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":18},4735,"c-ares",1,5,0,66,"2024-02-23","c",[16],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},19054,"C-ares is a technology vendor with 1 tracked product and 5 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[20,29,36,43,50],{"cveId":21,"description":22,"publishedDate":23,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":28},"CVE-2016-5180","Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.","2016-10-03",9.8,"v3.1","Critical",false,0.08583,{"cveId":30,"description":31,"publishedDate":32,"cvssScore":33,"cvssVersion":25,"severity":34,"isKev":27,"epssScore":35},"CVE-2017-1000381","The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.","2017-07-07",7.5,"High",0.0331,{"cveId":37,"description":38,"publishedDate":39,"cvssScore":40,"cvssVersion":25,"severity":41,"isKev":27,"epssScore":42},"CVE-2020-22217","Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.","2023-08-22",5.9,"Medium",0.00977,{"cveId":44,"description":45,"publishedDate":46,"cvssScore":47,"cvssVersion":25,"severity":48,"isKev":27,"epssScore":49},"CVE-2020-14354","A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.","2021-05-13",3.3,"Low",0.00529,{"cveId":51,"description":52,"publishedDate":13,"cvssScore":53,"cvssVersion":25,"severity":41,"isKev":27,"epssScore":54},"CVE-2024-25629","c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `\u002Fetc\u002Fresolv.conf`, `\u002Fetc\u002Fnsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `\u002Fetc\u002Fhosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.",4.4,0.00352,[],[57],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},{"title":59,"metaDescription":60,"keywords":61,"structuredData":62},"C-ares - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for C-ares covering 1 product with 5 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","C-ares vulnerabilities, C-ares security, C-ares CVE, C-ares threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":63,"@type":64,"name":65,"description":60,"url":66},"https:\u002F\u002Fschema.org","Organization","C-ares","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fc-ares",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":68,"apiVersion":69},"2026-10-17T20:25:23.317Z","3.0"]