CVE-2022-4904
C-ares Project C-ares: improper input validation can lead to denial of service
- Risk score
- 80/100
- CVSS
- 8.6 v3.1
- Exploit chance (30 days)
- 1.2%
- Published
- 6 Mar 2023
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw in the c-ares package allows a possible arbitrary length stack overflow, which may cause a denial of service or a limited impact on confidentiality and integrity. An attacker could exploit this flaw to cause a denial of service.
- Affected
- {'product': 'c-ares', 'vendor': 'c-ares project'}
- Fix
- Check the linked advisory for details on the fix
- Exploitation
- Public proof of concept
Why it is Red
- CVSS 8.6 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-8951-1
- https://bugzilla.redhat.com/show_bug.cgi?id=2168631
- https://github.com/c-ares/c-ares/issues/496
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33LDNS6RPOPP36Z4MPWXALUQZXJCWJS2/
- https://security.gentoo.org/glsa/202401-02
- https://bugzilla.redhat.com/show_bug.cgi?id=2168631
- https://github.com/c-ares/c-ares/issues/496
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33LDNS6RPOPP36Z4MPWXALUQZXJCWJS2/
- https://security.gentoo.org/glsa/202401-02
Original description
A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.
Last activity 21 Oct 2026. Patch Forecast updates every hour.