CVE-2021-3672: C-Ares Project C-Ares
Medium severity, CVSS 5.6. EPSS: 2.8% chance of exploitation in the next 30 days.
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.
Affected products
- C-Ares Project C-Ares: from 1.0.0, before 1.17.2 (fixed in 1.17.2)
- Fedoraproject Fedora: version 33 only; version 34 only
- Node.js Node.js: from 12.0.0, up to and including 12.12.0; from 12.13.0, before 12.22.5 (fixed in 12.22.5); from 14.0.0, up to and including 14.14.0; from 14.15.0, before 14.17.5 (fixed in 14.17.5); from 16.0.0, before 16.6.2 (fixed in 16.6.2)
- Pgbouncer Pgbouncer: up to and including 1.17.0
- Red Hat Enterprise Linux: version 7.0 only; version 7.7 only; version 8.0 only
- Red Hat Enterprise Linux Computer Node: version 1 only
- Red Hat Enterprise Linux Eus: version 7.7 only; version 8.1 only; version 8.2 only; version 8.4 only
- Red Hat Enterprise Linux For IBM Z Systems: version 8.0 only
- Red Hat Enterprise Linux For IBM Z Systems Eus: version 8.1 only; version 8.2 only; version 8.4 only
- Red Hat Enterprise Linux For Power Little Endian: version 8.0 only
- Red Hat Enterprise Linux For Power Little Endian Eus: version 8.1 only; version 8.2 only; version 8.4 only
- Red Hat Enterprise Linux Server Aus: version 8.2 only; version 8.4 only
- Red Hat Enterprise Linux Server Tus: version 8.2 only; version 8.4 only
- Red Hat Enterprise Linux Server Update Services For SAP Solutions: version 8.1 only; version 8.2 only; version 8.4 only
- Red Hat Enterprise Linux Tus: version 8.4 only
- Red Hat Enterprise Linux Workstation: version 1 only
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
Published 2021-11-23. Last modified 2026-06-17.