CVE-2023-31130

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-124 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: May 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-311319.1Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsaf CVE-2023-311327.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulne CVE-2023-311337.5Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to mem CVE-2023-311345.4Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites CVE-2023-311355.5Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisi CVE-2023-311365.9PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vuln CVE-2023-311377.5MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer CVE-2023-311386.5DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior t CVE-2023-311397.5DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior t CVE-2023-31147.7Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted b CVE-2023-311406.5OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and c CVE-2023-311415.9OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is