CyberRota Analysis
AI-GeneratedThe c-ares asynchronous resolver library prior to version 1.34.7 is vulnerable to denial-of-service attacks due to improper handling of DNS compression pointers, allowing a malicious DNS server to exploit the library by sending crafted responses that overwhelm the event loop. This can lead to significant service disruption as the resolver becomes unresponsive, impacting applications relying on DNS resolution. Organizations using c-ares in their systems should prioritize updating to version 1.34.7 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.