CVE-2023-31147 - CVE House
Back to Database
Status published Medium CVE-2023-31147

Insufficient randomness in generation of DNS query IDs in c-ares

Vulnerability Description

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-31147

Credits & Attribution

No credits recorded in the NVD database.

References

More from c-ares

View All →
CVE-2025-62408
c-ares has a Use After Free vulnerability when connection is cleaned up after error
Medium 5.9
CVE-2025-31498
c-ares has a use-after-free in read_answers()
High 8.3
CVE-2024-25629
c-ares out of bounds read in ares__read_line()
Medium 4.4
CVE-2023-32067
0-byte UDP payload DoS in c-ares
High 7.5
CVE-2023-31130
Buffer Underwrite in ares_inet_net_pton()
Medium 4.1

Affected Vendor

Affected Software

c-ares
Vulnerable Versions:
< 1.19.1

Timeline

Official Publish: May 25th, 2023
Last Modified: February 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-330

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.