At a glance
- Debian issued DSA-6626-1 with a security update for the c-ares library.
- Debian 13 (trixie) with c-ares 1.34.5-1+deb13u1 is affected; four CVEs are addressed.
- Potential impacts include denial of service, DNS spoofing, or information exposure.
- Prioritize updating to 1.34.9-1~deb13u1 from trixie-security.
Debian DSA-6626-1 updates c-ares to address four security vulnerabilities
Debian issued DSA-6626-1 with a c-ares security update for Debian 13 (trixie), addressing four vulnerabilities that may cause denial of service, DNS spoofing, or information exposure. Update affected c-ares 1.34.5-1+deb13u1 to 1.34.9-1~deb13u1 from trixie-security.
In this article
Debian published DSA-6626-1 for c-ares, an asynchronous DNS resolution library, to address four security vulnerabilities. See the Debian security advisory for the source information.
Overview and technical details
| Field | Details |
|---|---|
| Advisory | DSA-6626-1 |
| Product | c-ares, an asynchronous DNS resolution library |
| CVEs | CVE-2025-62408, CVE-2026-33630, CVE-2026-69184, CVE-2026-69186 |
| Source | Debian DSA |
Affected systems
| Product | Affected version | Fixed version |
|---|---|---|
| Debian 13 (trixie), c-ares | 1.34.5-1+deb13u1 | 1.34.9-1~deb13u1 (trixie-security) |
Mechanism and impact
The reported issues include use-after-free, double-free, buffer overflow, and excessive resource consumption when processing DNS messages. The advisory also describes accepting responses from unexpected DNS servers, reusing cached answers despite different EDNS options, and handling uninitialized memory for some IPv6 addresses.
Depending on how the library is used, the vulnerabilities may lead to denial of service, DNS spoofing, or information exposure.
System checks
Check the installed c-ares package version:
dpkg-query -W -f='${Version}\n' c-aresReview package policy and version information:
apt-cache policy c-aresCompare the installed version with the fixed version listed for trixie-security:
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' c-ares)" lt 1.34.9-1~deb13u1Versions lower than 1.34.9-1~deb13u1 need to be updated.
Remediation and mitigation
On Debian 13 (trixie) systems with an affected c-ares version, update the package from trixie-security to 1.34.9-1~deb13u1.
References
Related articles
Ubuntu Linux kernel for NVIDIA Tegra: check systems and apply security updates
Ubuntu USN-9091-1 warns of multiple vulnerabilities in the Linux kernel for NVIDIA Tegra. The supplied record gives no affected branches or fixed packages. Check installed kernels and packages, then consult the Ubuntu notice for the applicable update.
Linux Kernel: BPF Local Storage race condition may enable privilege escalation
ZDI-26-1007 describes a race condition in Linux Kernel BPF Local Storage. A local attacker needs high-privileged code execution; successful exploitation may enable privilege escalation and arbitrary code execution in the kernel context. Check the kernel version and apply the vendor update.