CVE-2023-31130 - CVE House
Back to Database
Status published Medium CVE-2023-31130

Buffer Underwrite in ares_inet_net_pton()

Vulnerability Description

c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-31130

Credits & Attribution

No credits recorded in the NVD database.

References

More from c-ares

View All →
CVE-2025-62408
c-ares has a Use After Free vulnerability when connection is cleaned up after error
Medium 5.9
CVE-2025-31498
c-ares has a use-after-free in read_answers()
High 8.3
CVE-2024-25629
c-ares out of bounds read in ares__read_line()
Medium 4.4
CVE-2023-32067
0-byte UDP payload DoS in c-ares
High 7.5
CVE-2023-31147
Insufficient randomness in generation of DNS query IDs in c-ares
Medium 5.9

Affected Vendor

Affected Software

c-ares
Vulnerable Versions:
< 1.19.1

Timeline

Official Publish: May 25th, 2023
Last Modified: February 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-124

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.