HOMEVULNERABILITIESCVE-2024-25629
MEDIUM

CVE-2024-25629

CWE-127Published: February 23, 2024· Updated: Jun 17, 2026

5.5
CVSS v3.1

Official Description

c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.

NVD Source

Technical Analysis

CVE-2024-25629 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 5.5.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityLow
Privileges Req.Low
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityNone
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Vendors & Products

c-ares1 product(s)
c-ares
Fedora1 product(s)
fedora
Source: NVD CPE · 4 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183
PATCHhttps://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183
ADVISORYhttps://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q
ADVISORYhttps://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q

All References (10)

→
https://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183Patch
→
https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48qVendor Advisory
→
https://lists.fedoraproject.org/archives/list/[email protected]/message/2P76QYINQNPEHUTEEDOUYIRZ2X6UVZ5K/Mailing List
→
https://lists.fedoraproject.org/archives/list/[email protected]/message/CSCMTSPDIE2UHU34TIXQQHZ6JTE3Y3VF/Mailing List
→
https://lists.fedoraproject.org/archives/list/[email protected]/message/GX37LFPFQ3T6FFMMFYQTEGIQXXN7F27U/Mailing List
→
https://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183Patch
→
https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48qVendor Advisory
→
https://lists.fedoraproject.org/archives/list/[email protected]/message/2P76QYINQNPEHUTEEDOUYIRZ2X6UVZ5K/Mailing List
→
https://lists.fedoraproject.org/archives/list/[email protected]/message/CSCMTSPDIE2UHU34TIXQQHZ6JTE3Y3VF/Mailing List
→
https://lists.fedoraproject.org/archives/list/[email protected]/message/GX37LFPFQ3T6FFMMFYQTEGIQXXN7F27U/Mailing List

Quick Facts

CVE IDCVE-2024-25629
CVSS Score5.5 / 10
SeverityMEDIUM
WeaknessCWE-127
CISA KEVNo
Affected2 vendor(s)
PublishedFeb 23, 2024

Related CVEs (CWE-127)

CVE-2020-1918
7.5
CVE-2026-5928
7.5
CVE-2024-10395
7.5
CVE-2020-5360
7.5
CVE-2025-20359
6.5
CVE-2025-32050
5.9

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2024-25629 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2024-25629·NVD