c-ares
3 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2022-4904 | unknown | A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possi | HIGH 8.6 | 1.2 % | ||
| CVE-2021-3672 | c-ares 1.17.2 | A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to o | MEDIUM 5.6 | 2.8 % | ||
| CVE-2020-14354 | c-ares 1.16.1 | A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. T | LOW 3.3 | 0.5 % |