CVE-2020-8277: C-Ares Project C-Ares

High severity, CVSS 7.5. EPSS: 54.2% chance of exploitation in the next 30 days.

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

Affected products

• C-Ares Project C-Ares: before 1.16.0 (fixed in 1.16.0)
• Fedoraproject Fedora: version 32 only; version 33 only
• Node.js Node.js: from 12.16.3, before 12.19.1 (fixed in 12.19.1); from 14.13.0, before 14.15.1 (fixed in 14.15.1); from 15.0.0, before 15.2.1 (fixed in 15.2.1)
• Oracle Blockchain Platform: before 21.1.2 (fixed in 21.1.2)
• Oracle Graalvm: version 19.3.4 only; version 20.3.0 only
• Oracle Jd Edwards Enterpriseone Tools: before 9.2.6.0 (fixed in 9.2.6.0)
• Oracle MySQL Cluster: up to and including 8.0.23
• Oracle Retail Xstore Point Of Service: version 16.0.6 only; version 17.0.4 only; version 18.0.3 only; version 19.0.2 only

Published 2020-11-19. Last modified 2026-06-17.