CVE-2023-31147: C-Ares Project C-Ares

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.

Affected products

• C-Ares Project C-Ares: before 1.19.1 (fixed in 1.19.1)
• Fedoraproject Fedora: version 37 only; version 38 only

Published 2023-05-25. Last modified 2026-06-17.