CVE-2022-4904: c-ares_project c-ares Improper Input Validation
Vulnerability summary
CVE-2022-4904 is a high (CVSS 8.6) Improper Input Validation vulnerability in c-ares_project c-ares. EPSS estimates a 1.22% chance of exploitation in the next 30 days, higher than 68.7% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 12 · Related 1Timeline
- 06-03-2023PublishedVulnerability first disclosed.
- 02-12-2025Last modifiedVulnerability information updated.
Description
A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · Red hatEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- OSV · DebianEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- NVDNIST8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
EPSS trend
Probability
1.22%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.22% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundC Ares
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-1284Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse23 products
- c-ares&distro=SUSE Enterprise Storage 7< 1.19.0-150000.3.20.1
- c-ares&distro=SUSE Enterprise Storage 7.1< 1.19.0-150000.3.20.1
- c-ares&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.19.0-150000.3.20.1
- c-ares&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.19.0-150000.3.20.1
- c-ares&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 1.19.0-150000.3.20.1
Redhat6 products
- enterprise_linux8.0 | 9.0
- software_collectionsna
- c-ares< 0:1.17.1-5.el9_0.2 | < 0:1.13.0-8.el8 | < 0:1.17.1-5.el9_2.2
- c-ares-debuginfo< 0:1.17.1-5.el9_0.2 | < 0:1.13.0-8.el8 | < 0:1.17.1-5.el9_2.2
- c-ares-debugsource< 0:1.17.1-5.el9_0.2 | < 0:1.13.0-8.el8 | < 0:1.17.1-5.el9_2.2
Opensuse3 products
- c-ares&distro=openSUSE Leap 15.4< 1.19.0-150000.3.20.1
- c-ares&distro=openSUSE Leap Micro 5.3< 1.19.0-150000.3.20.1
- c-ares&distro=openSUSE Tumbleweed< 1.19.0-2.1
C-ares_project1 product
- c-ares< 1.19.0
Debian1 product
- c-ares< 1.14.0-1+deb10u2 | < 1.18.1-2
Fedoraproject1 product
- fedoraEOL36
Mageia1 product
- c-ares< 1.17.1-1.2.mga8
Ubuntu1 product
- c-aresAll versions (No fix recorded) | < 1.10.0-3ubuntu0.2+esm4 | < 1.14.0-1ubuntu0.2 | < 1.15.0-1ubuntu0.2 | < 1.18.1-1ubuntu0.22.04.1
8 vendors · 37 products
References
27 links- lists.fedoraproject.org/archives/…Vendor Advisory
- security.gentoo.org/glsa/202401-02Vendor Advisory
