CVE-2016-5180: C-Ares

Critical severity, CVSS 9.8. EPSS: 8.6% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

Affected products

• C-Ares C-Ares: version 1.0.0 only; version 1.1.0 only; version 1.2.0 only; version 1.2.1 only; version 1.3.0 only; version 1.3.1 only; …
• C-Ares Project C-Ares: version 1.11.0 only
• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 16.10 only
• Debian Debian Linux: version 8.0 only
• Node.js Node.js: from 0.10.0, before 0.10.48 (fixed in 0.10.48); from 0.12.0, before 0.12.17 (fixed in 0.12.17); from 4.0.0, before 4.6.1 (fixed in 4.6.1)

Published 2016-10-03. Last modified 2026-06-17.