c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:7426 advisory.

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:4461 advisory.

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:4459 advisory.

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    * SQLite: integer overflow in SQLite (CVE-2025-3277)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:7433 advisory.

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    * SQLite: integer overflow in SQLite (CVE-2025-3277)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-19b0cab086 advisory.

    Update to 1.34.5. Fixes CVE-2025-31498.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:7426 advisory.

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7502 advisory.

    - Update c-ares with fix for CVE-2025-31498

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7502 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network     applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and     efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

    Security Fix(es):

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7433 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    * SQLite: integer overflow in SQLite (CVE-2025-3277)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7426 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7433 advisory.

    - Patch fix for sqlite CVE-2025-31498       Resolves: RHEL-87319
    - Update c-ares to newest version with fix for CVE-2025-31498       Resolves: RHEL-86586
    - Update to version 22.13.1       Fixes CVE-2025-23083 CVE-2025-23085 CVE-2025-22150       Resolves: RHEL-76354

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7426 advisory.

    nodejs     [1:20.19.1-1]
    - Update to version 20.19.1       Resolves: RHEL-78764

    [1:20.18.2-3]
    - Update c-ares to 1.34.5 to address CVE-2025-31498

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:7433 advisory.

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)
      * SQLite: integer overflow in SQLite (CVE-2025-3277)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0062 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-31498:
    c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in     read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the     upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the     connection immediately after a response. If there was an issue trying to put that new transaction on the     wire, it would close the connection handle, but read_answers() was still expecting the connection handle     to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger     this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and     can return a result with one of those conditions, this has been untested. Otherwise only a local attacker     might be able to change system behavior to make send()/write() return a failure condition. This     vulnerability is fixed in 1.34.5.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7537 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-3eb5235527 advisory.

    Update to version 22.15.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2c1f4c46d0 advisory.

    Update to version 22.15.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:4459 advisory.

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)
      * SQLite: integer overflow in SQLite (CVE-2025-3277)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:4461 advisory.

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-88025e98b2 advisory.

    Update to version 20.19.1


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-4461 advisory.

    nodejs     [1:20.19.1-1]
    - Update to version 20.19.1       Resolves: RHEL-78763

    [1:20.18.2-4]
    - Update c-ares to 1.34.5 to address CVE-2025-31498

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-4459 advisory.

    - Patch fix for sqlite CVE-2025-31498       Resolves: RHEL-87300

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.10 / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7477-1 advisory.

    It was discovered that c-ares incorrectly handled re-enqueuing certain queries. A remote attacker could     possibly use this issue to cause c-ares to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4459 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    * SQLite: integer overflow in SQLite (CVE-2025-3277)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4461 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-942 advisory.

    c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in     read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the     upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the     connection immediately after a response. If there was an issue trying to put that new transaction on the     wire, it would close the connection handle, but read_answers() was still expecting the connection handle     to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger     this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and     can return a result with one of those conditions, this has been untested. Otherwise only a local attacker     might be able to change system behavior to make send()/write() return a failure condition. This     vulnerability is fixed in 1.34.5. (CVE-2025-31498)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of c-ares installed on the remote host is affected by a use after free vulnerability. c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-942a0d7e5d advisory.

    Update to 1.34.5. Fixes CVE-2025-31498.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-c26ac54608 advisory.

    Update to 1.34.5. Fixes CVE-2025-31498.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
243147	RockyLinux 9 : nodejs:20 (RLSA-2025:7426)	Nessus	Rocky Linux Local Security Checks	high
243145	RockyLinux 8 : nodejs:20 (RLSA-2025:4461)	Nessus	Rocky Linux Local Security Checks	high
243083	RockyLinux 8 : nodejs:22 (RLSA-2025:4459)	Nessus	Rocky Linux Local Security Checks	high
243074	RockyLinux 9 : nodejs:22 (RLSA-2025:7433)	Nessus	Rocky Linux Local Security Checks	high
241302	Fedora 42 : c-ares (2025-19b0cab086)	Nessus	Fedora Local Security Checks	high
241243	AlmaLinux 9 : nodejs:20 (ALSA-2025:7426)	Nessus	Alma Linux Local Security Checks	high
240982	Oracle Linux 10 : nodejs22 (ELSA-2025-7502)	Nessus	Oracle Linux Local Security Checks	high
237849	RHEL 10 : nodejs22 (RHSA-2025:7502)	Nessus	Red Hat Local Security Checks	high
237321	RHEL 9 : nodejs:22 (RHSA-2025:7433)	Nessus	Red Hat Local Security Checks	high
237318	RHEL 9 : nodejs:20 (RHSA-2025:7426)	Nessus	Red Hat Local Security Checks	high
237202	Oracle Linux 9 : nodejs:22 (ELSA-2025-7433)	Nessus	Oracle Linux Local Security Checks	high
237128	Oracle Linux 9 : nodejs:20 (ELSA-2025-7426)	Nessus	Oracle Linux Local Security Checks	high
237009	AlmaLinux 9 : nodejs:22 (ALSA-2025:7433)	Nessus	Alma Linux Local Security Checks	high
236940	Alibaba Cloud Linux 3 : 0062: nodejs:20 (ALINUX3-SA-2025:0062)	Nessus	Alibaba Cloud Linux Local Security Checks	high
235930	RHEL 9 : nodejs:20 (RHSA-2025:7537)	Nessus	Red Hat Local Security Checks	high
235689	Fedora 40 : nodejs22 (2025-3eb5235527)	Nessus	Fedora Local Security Checks	high
235685	Fedora 41 : nodejs22 (2025-2c1f4c46d0)	Nessus	Fedora Local Security Checks	high
235603	AlmaLinux 8 : nodejs:22 (ALSA-2025:4459)	Nessus	Alma Linux Local Security Checks	high
235600	AlmaLinux 8 : nodejs:20 (ALSA-2025:4461)	Nessus	Alma Linux Local Security Checks	high
235427	Fedora 41 : nodejs20 (2025-88025e98b2)	Nessus	Fedora Local Security Checks	high
235154	Oracle Linux 8 : nodejs:20 (ELSA-2025-4461)	Nessus	Oracle Linux Local Security Checks	high
235151	Oracle Linux 8 : nodejs:22 (ELSA-2025-4459)	Nessus	Oracle Linux Local Security Checks	high
235139	Ubuntu 24.10 / 25.04 : c-ares vulnerability (USN-7477-1)	Nessus	Ubuntu Local Security Checks	high
235135	RHEL 8 : nodejs:22 (RHSA-2025:4459)	Nessus	Red Hat Local Security Checks	high
235129	RHEL 8 : nodejs:20 (RHSA-2025:4461)	Nessus	Red Hat Local Security Checks	high
234936	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2025-942)	Nessus	Amazon Linux Local Security Checks	high
234803	c-ares 1.32.3 < 1.34.5 Use After Free (macOS)	Nessus	MacOS X Local Security Checks	high
234785	Fedora 40 : c-ares (2025-942a0d7e5d)	Nessus	Fedora Local Security Checks	high
234696	Fedora 41 : c-ares (2025-c26ac54608)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2025-31498

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high