What is the CVSS score of CVE-2025-62408?

CVE-2025-62408 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of C Ares are affected by CVE-2025-62408?

Organizations using c-ares should be aware of moderate risk from CVE-2025-62408, a use-after-free vulnerability rated CVSS 5.9. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-62408?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

C Ares CVE-2025-62408

EUVD-2025-201830 MEDIUM

Use After Free (CWE-416)

2025-12-08 security-advisories@github.com

Use After Free Memory Corruption Denial Of Service C Ares Red Hat Suse

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Red Hat

5.9 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 17:54 euvd

EUVD-2025-201830

Analysis Generated

Mar 15, 2026 - 17:54 vuln.today

Patch released

Mar 15, 2026 - 17:54 nvd

Patch available

CVE Published

Dec 08, 2025 - 22:15 nvd

MEDIUM 5.9

DescriptionGitHub Advisory

c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

Analysis

Technical ContextAI

A use-after-free vulnerability occurs when a program continues to use a pointer after the referenced memory has been freed, leading to undefined behavior. This vulnerability is classified as Use After Free (CWE-416).

RemediationAI

A vendor patch is available — apply it immediately. Use memory-safe languages. Implement proper object lifecycle management. Use static and dynamic analysis tools to detect UAF patterns.

More in C Ares

View all

CVE-2016-5180 CRITICAL Act Now

9.8 Oct 03

Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to caus

CVE-2021-3672 MEDIUM This Month POC

5.6 Nov 23

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Se

CVE-2017-1000381 HIGH This Week

7.5 Jul 07

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read me

CVE-2023-32067 HIGH This Week

7.5 May 25

c-ares is an asynchronous resolver library. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,

CVE-2020-8277 HIGH This Week

7.5 Nov 19

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial

CVE-2023-31147 MEDIUM This Month

6.5 May 25

c-ares is an asynchronous resolver library. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable

CVE-2023-31130 MEDIUM This Month

6.4 May 25

c-ares is an asynchronous resolver library. Rated medium severity (CVSS 6.4). No vendor patch available.

CVE-2023-31124 LOW Monitor

3.7 May 25

c-ares is an asynchronous resolver library. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, n

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Use After Free

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

CVE-2012-4969 HIGH POC

8.1

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Micro 5.2	Fixed
SUSE Linux Enterprise Micro 5.3	Fixed

CVE-2025-62408 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Micro 5.4	Fixed
SUSE Linux Enterprise Micro 5.5	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
SUSE Linux Micro 6.0	Fixed
SUSE Linux Micro 6.1	Fixed
SUSE Linux Micro 6.2	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP4	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP5	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP6	Fixed
SUSE Linux Enterprise Server 15 SP4	Fixed
SUSE Linux Enterprise Server 15 SP4-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP5	Fixed
SUSE Linux Enterprise Server 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP6	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Manager Proxy 4.3	Fixed
SUSE Manager Proxy LTS 4.3	Fixed
SUSE Manager Retail Branch Server 4.3	Fixed
SUSE Manager Retail Branch Server LTS 4.3	Fixed
SUSE Manager Server 4.3	Fixed
SUSE Manager Server LTS 4.3	Fixed
SUSE CaaS Platform 4.0	Fixed
SUSE Enterprise Storage 6	Fixed
SUSE Enterprise Storage 7	Fixed
SUSE Enterprise Storage 7.1	Fixed
SUSE Linux Enterprise Desktop 15	Fixed
SUSE Linux Enterprise Desktop 15 SP1	Fixed
SUSE Linux Enterprise Desktop 15 SP2	Fixed
SUSE Linux Enterprise Desktop 15 SP4	Fixed
SUSE Linux Enterprise Desktop 15 SP5	Fixed
SUSE Linux Enterprise Desktop 15 SP6	Fixed
SUSE Linux Enterprise High Performance Computing 15	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP1	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP2	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP6	Fixed
SUSE Linux Enterprise High Performance Computing 15-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15-LTSS	Fixed
SUSE Linux Enterprise Micro 5.1	Fixed
SUSE Linux Enterprise Module for Basesystem 15	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP1	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP2	Fixed
SUSE Linux Enterprise Real Time 15 SP2	Fixed
SUSE Linux Enterprise Real Time 15 SP3	Fixed
SUSE Linux Enterprise Real Time 15 SP4	Fixed
SUSE Linux Enterprise Server 15	Fixed
SUSE Linux Enterprise Server 15 SP1	Fixed
SUSE Linux Enterprise Server 15 SP1-BCL	Fixed
SUSE Linux Enterprise Server 15 SP1-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP2	Fixed
SUSE Linux Enterprise Server 15 SP2-BCL	Fixed
SUSE Linux Enterprise Server 15 SP2-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP3-LTSS	Fixed
SUSE Linux Enterprise Server 15-LTSS	Fixed
SUSE Linux Enterprise Server for SAP Applications 15	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP1	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP2	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP3	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Manager Proxy 4.0	Fixed
SUSE Manager Proxy 4.1	Fixed
SUSE Manager Proxy 4.2	Fixed
SUSE Manager Retail Branch Server 4.0	Fixed
SUSE Manager Retail Branch Server 4.1	Fixed
SUSE Manager Retail Branch Server 4.2	Fixed
SUSE Manager Server 4.0	Fixed
SUSE Manager Server 4.1	Fixed
SUSE Manager Server 4.2	Fixed
openSUSE Leap 15.4	Fixed
openSUSE Leap 15.5	Fixed
openSUSE Leap Micro 5.2	Fixed
openSUSE Leap Micro 5.3	Fixed
openSUSE Leap Micro 5.4	Fixed
openSUSE Leap Micro 5.5	Fixed

C Ares CVE-2025-62408

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

Analysis

Technical ContextAI

RemediationAI

More in C Ares

Same weakness CWE-416 – Use After Free

Same technique Use After Free

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code