Home / mailings [SECURITY] [DSA 6626-1] c-ares security update
Posted on 13 November 2026
Debian Security Advisory- -------------------------------------------------------------------------
Debian Security Advisory DSA-6626-1 security@debian.org
https://www.debian.org/security/ Aron Xu
November 13, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : c-ares
CVE ID : CVE-2025-62408 CVE-2026-33630 CVE-2026-69184 CVE-2026-69186
Several vulnerabilities have been discovered in c-ares, an asynchronous DNS
resolver library, which may result in denial of service, DNS spoofing, or
information disclosure, depending on how the library is used.
These flaws include memory corruption issues (use-after-free, double-free,
and buffer overflows), excessive resource consumption during DNS message
processing, acceptance of replies from unexpected DNS servers, improper
reuse of cached answers with differing EDNS options, and the handling of
uninitialized memory for certain IPv6 addresses.
For the stable distribution (trixie), these problems have been fixed in
version 1.34.9-1~deb13u1.
We recommend that you upgrade your c-ares packages.
For the detailed security status of c-ares please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/c-ares
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
