CVE-2020-14354: C-Ares

Low severity, CVSS 3.3. EPSS: 0.5% chance of exploitation in the next 30 days.

A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.

Affected products

• C-Ares C-Ares: version 1.16.0 only
• Fedoraproject Fedora: version 33 only

Published 2021-05-13. Last modified 2026-06-17.