Back to Database
Status published
High
CVE-2023-32067
0-byte UDP payload DoS in c-ares
Vulnerability Description
c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-32067
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vc
- https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/
- https://www.debian.org/security/2023/dsa-5419
- https://lists.debian.org/debian-lts-announce/2023/06/msg00034.html
- https://security.gentoo.org/glsa/202310-09
- https://security.netapp.com/advisory/ntap-20240605-0004/
More from c-ares
View All →CVE-2025-62408
c-ares has a Use After Free vulnerability when connection is cleaned up after error
Medium
5.9
CVE-2025-31498
c-ares has a use-after-free in read_answers()
High
8.3
CVE-2024-25629
c-ares out of bounds read in ares__read_line()
Medium
4.4
CVE-2023-31147
Insufficient randomness in generation of DNS query IDs in c-ares
Medium
5.9
CVE-2023-31130
Buffer Underwrite in ares_inet_net_pton()
Medium
4.1
Affected Vendor
c-ares
View all reports →Affected Software
c-ares
Vulnerable Versions:
< 1.19.1
Timeline
Official Publish:
May 25th, 2023
Last Modified:
February 13th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H