CVE-2025-62408: 
npm vulnerability analysis and mitigation

CVE-2025-62408 is a Use-After-Free (UAF) vulnerability in the c-ares asynchronous DNS resolver library affecting versions 1.32.3 through 1.34.5. The flaw occurs in read_answer() when process_answer() terminates a query after maximum attempts, causing the connection to be closed while additional answers may still be processed — leading to a Denial of Service (crash). It was disclosed on December 8, 2025, and is described as a missed case from the earlier CVE-2025-31498. The CVSS v3.1 base score is 5.9 (Medium) (GitHub Advisory, Microsoft MSRC).

The root cause is a Use-After-Free condition (CWE-416) in c-ares's DNS query processing logic. When process_answer() determines a query has exceeded its maximum retry attempts, it terminates the query and closes the associated connection; however, read_answer() may continue to process additional DNS answers using the now-freed connection object. The fix (commit 714bf56) enqueues query callbacks to be processed within process_answer() rather than calling them directly, preventing the connection from being destroyed while still in use, and also duplicates DNS records before cache insertion to avoid shared ownership issues (GitHub Advisory, GitHub Commit). Exploitation requires high attack complexity, as an attacker must craft DNS responses that trigger the specific retry-exhaustion code path.

Successful exploitation results in a crash of the application using the vulnerable c-ares library, causing a Denial of Service. There is no confidentiality or integrity impact — the vulnerability exclusively affects availability. Affected products include c-ares versions 1.32.3–1.34.5 and downstream consumers such as Microsoft's azl3_fluent-bit 3.1.10-2, Oracle Solaris 11.4, IBM API Connect, Splunk AppDynamics Private Synthetic Agent, and Istio (GitHub Advisory, Oracle Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.04%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. High attack complexity is required, as the attacker must control or influence DNS responses to trigger the retry-exhaustion path in the library (GitHub Advisory).

Upgrade c-ares to version 1.34.6 or later, which includes the fix in commit 714bf56. No workarounds are available according to the upstream advisory. Downstream product users should apply vendor-specific updates: Oracle Solaris 11.4 users should apply the patch referenced in the January 2026 Third Party Bulletin, Splunk AppDynamics users should apply the March 2026 update (SVD-2026-0309), IBM API Connect users should refer to IBM support note 7269428, and Istio users should upgrade to 1.27.5 or later (GitHub Advisory, Oracle Bulletin).

A technical blog post from Pomerium titled "It's Always DNS" provided a detailed write-up tracking down the use-after-free bug in Envoy's DNS resolver via c-ares, drawing community attention to the vulnerability's real-world impact in service mesh environments. The vulnerability was reported by researcher kralicky and patched by c-ares maintainer bradh352. Distribution-level advisories were issued for Ubuntu, Debian, SUSE, and Slackware, indicating broad ecosystem awareness and rapid patching activity (GitHub Advisory).